Trojaner-Board - Google erzwingt falsche Links

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Google erzwingt falsche Links (https://www.trojaner-board.de/70088-google-erzwingt-falsche-links.html)

jackaces

17.02.2009 00:28

Google erzwingt falsche Links

Hallo ihr Helfer meines Problems.

Ich sitze jetzt seit fünf Stunden an meinem Laptop und versuch alles was in meiner Macht steht um ihn wieder vernünftig zum laufen zu bringen.
Ich hab gemerkt das was nicht stimmt, als mein Google mich andauern auf irgendwelche komischen Seiten weiter geleitet hat.
Ich hab alles durchgelesen und versucht zu verstehen, aber es dauert auch ewig auf die nächste Seite zukommen. (für das TrojanerForum hab ich mal an die 30 min gebraucht)

Ich hoffe ihr könnt mir mit meiner LogFile weiterhelfen.
Ich bedanke mich schon mal im voraus. R.

Code Tags

Code:



Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 21:13:28, on 16.02.2009

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18000)

Boot mode: Normal
 

Running processes:

C:\Windows\System32\smss.exe

C:\Windows\system32\csrss.exe

C:\Windows\system32\wininit.exe

C:\Windows\system32\csrss.exe

C:\Windows\system32\services.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\winlogon.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\TAMSvr.exe

C:\Windows\system32\nvvsvc.exe

C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe

C:\Windows\system32\svchost.exe

C:\Windows\System32\svchost.exe

C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe

C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\SLsvc.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\rundll32.exe

C:\Windows\system32\svchost.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\agrsmsvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe

C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe

C:\Program Files\Spyware Doctor\pctsAuxs.exe

C:\Program Files\Spyware Doctor\pctsSvc.exe

C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe

C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

C:\Windows\system32\svchost.exe

C:\Program Files\Toshiba TEMPRO\TempoSVC.exe

C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe

C:\Windows\system32\TODDSrv.exe

c:\Program Files\Toshiba\Power Saver\TosCoSrv.exe

c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe

c:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe

C:\Windows\System32\TUProgSt.exe

C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

C:\Windows\System32\svchost.exe

C:\Windows\system32\taskeng.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Windows Defender\MSASCui.exe

C:\Windows\RtHDVCpl.exe

C:\Program Files\Toshiba\Bluetooth Toshiba Stack\ItSecMng.exe

C:\Program Files\Apoint2K\Apoint.exe

C:\Program Files\Spyware Doctor\pctsTray.exe

C:\Program Files\Apoint2K\ApMsgFwd.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files\Apoint2K\Apntex.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\svchost.exe

C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe

C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe

C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe

C:\Program Files\PC Connectivity Solution\Transports\NclToBTSrv.exe

C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe

C:\Program Files\MAGIX\Common\Database\bin\fabs.exe

C:\Program Files\BitDefender\BitDefender 2009\seccenter.exe

C:\Windows\system32\wbem\unsecapp.exe

c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe

c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe

c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe

c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe

c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe

C:\Program Files\Internet Explorer\ieuser.exe

c:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe

C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtProc.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe

C:\Windows\system32\taskeng.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

C:\Windows\system32\wbem\wmiprvse.exe
 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll

O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: D - {930088ED-0402-3092-BD1E-C595A5A8D0D4} - C:\Windows\system32\xwr27775.dll

O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe

O4 - HKLM\..\Run: [ITSecMng] %ProgramFiles%\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe /START

O4 - HKLM\..\Run: [SVPWUTIL] C:\Program Files\TOSHIBA\Utilities\SVPWUTIL.exe SVPwUTIL

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe

O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe"

O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"

O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray

O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')

O4 - .DEFAULT User Startup: TRDCReminder.lnk = C:\Program Files\Toshiba\TRDCReminder\TRDCReminder.exe (User 'Default user')

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll

O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

O9 - Extra button: eBay - Der weltweite Online Marktplatz - {76577871-04EC-495E-A12B-91F7C3600AFA} - http://rover.ebay.com/rover/1/707-44556-9400-3/4 (file missing)

O9 - Extra button: Amazon.de - {8A918C1D-E123-4E36-B562-5C1519E434CE} - http://www.amazon.de/exec/obidos/redirect-home?tag=Toshibadebholink-21&site=home (file missing)

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL

O13 - Gopher Prefix: 

O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab

O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Planer (AntiVirScheduler) - Unknown owner - D:\Avira\AntiVir PersonalEdition Classic\sched.exe (file missing)

O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Unknown owner - D:\Avira\AntiVir PersonalEdition Classic\avguard.exe (file missing)

O23 - Service: BitDefender Arrakis Server (Arrakis3) - BitDefender S.R.L. http://www.bitdefender.com - C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe

O23 - Service: Authentec memory manager service (Authentec memory manager) - AuthenTec Inc. - C:\Windows\system32\TAMSvr.exe

O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: ConfigFree Service - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe

O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe

O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe

O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe

O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

O23 - Service: SmartFaceVWatchSrv - Toshiba - C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe

O23 - Service: Notebook Performance Tuning Service  (TempoMonitoringService) - Toshiba Europe GmbH - C:\Program Files\Toshiba TEMPRO\TempoSVC.exe

O23 - Service: TOSHIBA Navi Support Service (TNaviSrv) - TOSHIBA Corporation - C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe

O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe

O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - c:\Program Files\Toshiba\Power Saver\TosCoSrv.exe

O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe

O23 - Service: TOSHIBA SMART Log Service - TOSHIBA Corporation - c:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe

O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Windows\System32\TuneUpDefragService.exe

O23 - Service: @%SystemRoot%\System32\TUProgSt.exe,-1 (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\Windows\System32\TUProgSt.exe

O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S. R. L. - C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe
 

--

End of file - 11461 bytes
 

:)

Chris4You

17.02.2009 08:36

Hi,

das HJ-Log gibt nicht viel her, daher liegt der verdacht auf was "verstecktes" nahe....

Combofix
Lade ComboFix von http://download.bleepingcomputer.com/sUBs/ComboFix.exe und speichert es auf den Desktop.
Alle Fenster schliessen und combofix.exe starten und bestätige die folgende Abfrage mit 1 und drücke Enter.

Der Scan mit Combofix kann einige Zeit in Anspruch nehmen, also habe etwas Geduld. Während des Scans bitte nichts am Rechner unternehmen
Es kann möglich sein, dass der Rechner zwischendurch neu gestartet wird.
Nach Scanende wird ein Report angezeigt, den bitte kopieren und in deinem Thread einfuegen.
Weitere Anleitung unter:http://www.bleepingcomputer.com/combofix/de/wie-combofix-benutzt-wird
Hinweis: unter : C:\WINDOWS\erdnt
wird ein Backup angelegt.
Alternative downloads: http://subs.geekstogo.com/ComboFix.exe

Danach noch scannen mit MAM:
Malwarebytes Antimalware (MAM).
Anleitung&Download hier: http://www.trojaner-board.de/51187-malwarebytes-anti-malware.html
Fullscan und alles bereinigen lassen! Log posten.
Alternativer Download: http://filepony.de/download-malwarebytes_anti_malware/, http://www.gt500.org/malwarebytes/mbam.jsp

chris

jackaces

17.02.2009 14:26

so, hab jetzt auch das erledigt
zusätzlich hab ich Tröjan.Vundo.H 7x gefunden.?

aber
Der Text, den Sie eingegeben haben, besteht aus 26212 Zeichen und ist damit zu lang. Bitte kürzen Sie den Text auf die maximale Länge von 25000 Zeichen.

wie gehe ich damit vor?

jackaces

17.02.2009 14:29

Code:

Malwarebytes' Anti-Malware 1.34

Datenbank Version: 1749

Windows 6.0.6001 Service Pack 1
 

17.02.2009 13:34:03

mbam-log-2009-02-17 (13-34-03).txt
 

Scan-Methode: Quick-Scan

Durchsuchte Objekte: 62667

Laufzeit: 2 minute(s), 54 second(s)
 

Infizierte Speicherprozesse: 0

Infizierte Speichermodule: 1

Infizierte Registrierungsschlüssel: 5

Infizierte Registrierungswerte: 0

Infizierte Dateiobjekte der Registrierung: 0

Infizierte Verzeichnisse: 0

Infizierte Dateien: 2
 

Infizierte Speicherprozesse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule:

C:\Windows\System32\xwr27775.dll (Trojan.Vundo.H) -> Delete on reboot.
 

Infizierte Registrierungsschlüssel:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{930088ed-0402-3092-bd1e-c595a5a8d0d4} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{930088ed-0402-3092-bd1e-c595a5a8d0d4} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\TypeLib\{e762b976-44d9-3776-aa52-6c3ccd940e4f} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{4767d3c2-47a7-3f18-845f-a586dd7cd636} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{930088ed-0402-3092-bd1e-c595a5a8d0d4} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
 

Infizierte Registrierungswerte:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung:

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien:

C:\Windows\System32\xwr27775.dll (Trojan.Vundo.H) -> Delete on reboot.

C:\Windows\System32\wr27775.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
 

:)

Chris4You

17.02.2009 15:26

Hi,

poste es in zwei Teilen...

chris

jackaces

17.02.2009 20:53

wieso komm ich da nicht selbst drauf. merk ich mir.

Code:


 

ComboFix 09-02-15.01 - *** 2009-02-17 20:39:30.2 - NTFSx86

Microsoft® Windows Vista™ Home Premium   6.0.6001.1.1252.1.1031.18.3066.1990 [GMT 1:00]

ausgeführt von:: c:\users\***\Desktop\ComboFix.exe

AV: BitDefender Antivirus *On-access scanning enabled* (Updated)

FW: BitDefender Firewall *enabled*

.
 

(((((((((((((((((((((((   Dateien erstellt von 2009-01-17 bis 2009-02-17  ))))))))))))))))))))))))))))))

.
 

2009-02-17 12:55 . 2009-02-17 12:55        <DIR>        d--------        c:\users\***\AppData\Roaming\Malwarebytes

2009-02-17 12:55 . 2009-02-11 10:19        15,504        --a------        c:\windows\System32\drivers\mbam.sys

2009-02-17 12:52 . 2009-02-11 10:19        38,496        --a------        c:\windows\System32\drivers\mbamswissarmy.sys

2009-02-17 01:07 . 2009-02-17 03:08        <DIR>        d--------        c:\program files\a-squared Anti-Malware

2009-02-16 21:29 . 2009-02-16 21:29        <DIR>        d--------        c:\program files\CCleaner

2009-02-16 21:28 . 2009-02-16 21:28        <DIR>        d--------        c:\users\All Users\Malwarebytes

2009-02-16 21:28 . 2009-02-16 21:28        <DIR>        d--------        c:\programdata\Malwarebytes

2009-02-16 21:28 . 2009-02-17 12:55        <DIR>        d--------        c:\program files\Malwarebytes' Anti-Malware

2009-02-16 20:55 . 2007-06-28 14:36        401,720        --a------        c:\users\All Users\HijackThis.exe

2009-02-16 20:55 . 2007-06-28 14:36        401,720        --a------        c:\programdata\HijackThis.exe

2009-02-16 20:29 . 2009-02-16 20:29        <DIR>        d--------        c:\program files\Trend Micro

2009-02-15 21:37 . 2009-02-17 13:25        <DIR>        d-a------        c:\users\All Users\TEMP

2009-02-15 21:37 . 2009-02-17 13:25        <DIR>        d-a------        c:\programdata\TEMP

2009-02-15 21:37 . 2008-08-25 12:36        81,288        --a------        c:\windows\System32\drivers\iksyssec.sys

2009-02-15 21:37 . 2008-08-25 12:36        66,952        --a------        c:\windows\System32\drivers\iksysflt.sys

2009-02-15 21:37 . 2008-08-25 12:36        40,840        --a------        c:\windows\System32\drivers\ikfilesec.sys

2009-02-15 21:37 . 2008-06-02 16:19        29,576        --a------        c:\windows\System32\drivers\kcom.sys

2009-02-15 21:36 . 2009-02-15 21:36        <DIR>        d--------        c:\users\***\AppData\Roaming\PC Tools

2009-02-15 21:36 . 2009-02-15 22:13        <DIR>        d--------        c:\program files\Spyware Doctor

2009-02-15 21:24 . 2008-06-20 02:14        105,016        --a------        c:\windows\System32\PresentationCFFRasterizerNative_v0300.dll

2009-02-15 21:24 . 2008-06-20 02:14        97,800        --a------        c:\windows\System32\infocardapi.dll

2009-02-15 21:23 . 2008-06-20 02:14        781,344        --a------        c:\windows\System32\PresentationNative_v0300.dll

2009-02-15 21:23 . 2008-06-20 02:14        622,080        --a------        c:\windows\System32\icardagt.exe

2009-02-15 21:23 . 2008-06-20 02:14        326,160        --a------        c:\windows\System32\PresentationHost.exe

2009-02-15 21:23 . 2008-06-20 02:14        43,544        --a------        c:\windows\System32\PresentationHostProxy.dll

2009-02-15 21:23 . 2008-06-20 02:14        37,384        --a------        c:\windows\System32\infocardcpl.cpl

2009-02-15 21:23 . 2008-06-20 02:14        11,264        --a------        c:\windows\System32\icardres.dll

2009-02-15 21:18 . 2008-07-27 19:03        282,112        --a------        c:\windows\System32\mscoree.dll

2009-02-15 21:18 . 2008-07-27 19:03        158,720        --a------        c:\windows\System32\mscorier.dll

2009-02-15 21:18 . 2008-07-27 19:03        96,760        --a------        c:\windows\System32\dfshim.dll

2009-02-15 21:18 . 2008-07-27 19:03        83,968        --a------        c:\windows\System32\mscories.dll

2009-02-15 21:18 . 2008-07-27 19:03        41,984        --a------        c:\windows\System32\netfxperf.dll

2009-02-14 17:27 . 2005-05-26 15:34        2,297,552        --a------        c:\windows\System32\d3dx9_26.dll

2009-02-14 17:15 . 2009-02-14 17:15        <DIR>        dr-------        c:\windows\System32\config\systemprofile\Videos

2009-02-14 17:15 . 2009-02-14 17:15        <DIR>        dr-------        c:\windows\System32\config\systemprofile\Searches

2009-02-14 17:15 . 2009-02-14 17:15        <DIR>        dr-------        c:\windows\System32\config\systemprofile\Saved Games

2009-02-14 17:15 . 2009-02-14 17:15        <DIR>        dr-------        c:\windows\System32\config\systemprofile\Pictures

2009-02-14 17:15 . 2009-02-14 17:15        <DIR>        dr-------        c:\windows\System32\config\systemprofile\Music

2009-02-14 17:15 . 2009-02-14 17:15        <DIR>        dr-------        c:\windows\System32\config\systemprofile\Links

2009-02-14 17:15 . 2009-02-14 17:15        <DIR>        dr-------        c:\windows\System32\config\systemprofile\Downloads

2009-02-14 17:15 . 2009-02-14 17:15        <DIR>        dr-------        c:\windows\System32\config\systemprofile\Documents

2009-02-14 17:11 . 2009-02-14 17:11        <DIR>        d--------        c:\program files\DAEMON Tools Lite

2009-02-14 17:05 . 2009-02-14 17:05        <DIR>        d--------        c:\users\***\AppData\Roaming\DAEMON Tools

2009-02-14 17:05 . 2009-02-14 17:05        717,296        --a------        c:\windows\System32\drivers\sptd.sys

2009-02-14 03:37 . 2009-02-14 04:00        <DIR>        d--------        c:\users\***\AppData\Roaming\BPK

2009-02-13 15:11 . 2009-02-13 15:11        <DIR>        d--------        c:\users\***\AppData\Roaming\PC Suite

2009-02-13 15:11 . 2009-02-13 15:11        <DIR>        d--------        c:\users\***\AppData\Roaming\BitDefender

2009-02-13 15:07 . 2009-02-16 19:30        <DIR>        d--------        c:\users\***\Program Files

2009-02-13 15:07 . 2009-02-17 20:39        81,984        --a------        c:\windows\System32\bdod.bin

2009-02-13 12:13 . 2009-02-13 12:13        <DIR>        d--------        c:\program files\Common Files\Macrovision Shared

2009-02-13 12:11 . 2009-02-13 12:10        73,728        --a------        c:\windows\System32\xa68148085.exe

2009-02-13 12:10 . 2009-02-13 12:10        73,728        --a------        c:\windows\System32\xa68147897.exe

2009-02-13 02:00 . 2009-02-13 02:00        <DIR>        d--------        c:\users\***\AppData\Roaming\MAGIX

2009-02-13 01:58 . 2009-02-13 01:58        603,904        --a------        c:\windows\System32\TUProgSt.exe

2009-02-13 01:58 . 2009-02-13 01:58        360,192        --a------        c:\windows\System32\TuneUpDefragService.exe

2009-02-13 01:58 . 2008-12-11 13:31        27,904        --a------        c:\windows\System32\uxtuneup.dll

2009-02-13 01:58 . 2008-12-11 13:31        17,152        --a------        c:\windows\System32\authuitu.dll

2009-02-13 01:55 . 2009-02-13 01:55        <DIR>        d--------        c:\users\***\AppData\Roaming\TuneUp Software

2009-02-13 01:54 . 2009-02-13 01:54        <DIR>        d--------        c:\users\All Users\TuneUp Software

2009-02-13 01:54 . 2009-02-13 01:54        <DIR>        d--hs----        c:\users\All Users\{55A29068-F2CE-456C-9148-C869879E2357}

2009-02-13 01:54 . 2009-02-13 01:54        <DIR>        d--------        c:\programdata\TuneUp Software

2009-02-13 01:54 . 2009-02-13 01:54        <DIR>        d--hs----        c:\programdata\{55A29068-F2CE-456C-9148-C869879E2357}

2009-02-13 01:54 . 2009-02-13 01:58        <DIR>        d--------        c:\program files\TuneUp Utilities 2009

2009-02-12 18:40 . 2009-02-12 18:40        0        --ah-----        c:\windows\System32\drivers\Msft_User_PCCSWpdDriver_01_05_00.Wdf

2009-02-12 18:40 . 2009-02-12 18:40        0        --ah-----        c:\windows\System32\drivers\Msft_Kernel_ccdcmb_01007.Wdf

2009-02-12 18:39 . 2009-02-12 18:40        <DIR>        d--------        c:\users\***\AppData\Roaming\PC Suite

2009-02-12 18:39 . 2009-02-16 18:16        <DIR>        d--------        c:\users\***\AppData\Roaming\Nokia

2009-02-12 18:39 . 2009-02-12 18:40        <DIR>        d--------        c:\users\All Users\PC Suite

2009-02-12 18:39 . 2009-02-12 18:40        <DIR>        d--------        c:\programdata\PC Suite

2009-02-12 18:35 . 2009-02-12 18:35        <DIR>        d--------        c:\program files\Common Files\PCSuite

2009-02-12 18:35 . 2009-02-12 18:35        <DIR>        d--------        c:\program files\Common Files\Nokia

2009-02-12 18:35 . 2008-08-26 09:26        18,816        --a------        c:\windows\System32\drivers\pccsmcfd.sys

2009-02-12 18:34 . 2009-02-12 18:34        <DIR>        d--------        c:\program files\PC Connectivity Solution

2009-02-12 18:32 . 2009-02-12 18:35        <DIR>        d--------        c:\program files\Nokia

2009-02-12 18:32 . 2008-09-15 07:56        91,136        --a------        c:\windows\System32\nmwcdcls.dll

2009-02-12 18:31 . 2009-02-12 18:31        <DIR>        d--------        c:\users\All Users\Installations

2009-02-12 18:31 . 2009-02-12 18:31        <DIR>        d--------        c:\programdata\Installations

2009-02-12 17:58 . 2009-02-12 17:58        <DIR>        d--------        c:\program files\Microsoft Silverlight

2009-02-12 17:58 . 2009-02-12 17:58        <DIR>        d--------        c:\program files\Microsoft

2009-02-12 17:56 . 2009-02-12 17:56        <DIR>        d--------        c:\windows\Sun

2009-02-12 17:44 . 2008-12-05 05:32        428,544        --a------        c:\windows\System32\EncDec.dll

2009-02-12 17:44 . 2008-12-05 05:32        293,376        --a------        c:\windows\System32\psisdecd.dll

2009-02-12 17:44 . 2008-12-05 05:31        217,088        --a------        c:\windows\System32\psisrndr.ax

2009-02-12 17:44 . 2008-12-05 05:31        177,664        --a------        c:\windows\System32\mpg2splt.ax

2009-02-12 17:44 . 2008-12-05 05:31        80,896        --a------        c:\windows\System32\MSNP.ax

2009-02-12 17:17 . 2009-02-12 17:17        850        --a------        c:\windows\System32\ProductTweaks.xml

2009-02-12 17:17 . 2009-02-12 17:17        385        --a------        c:\windows\System32\user_gensett.xml

2009-02-12 14:24 . 2009-02-12 14:24        <DIR>        d--------        c:\users\***\AppData\Roaming\BitDefender

2009-02-12 14:24 . 2009-02-12 17:16        <DIR>        d--------        c:\users\All Users\BitDefender

2009-02-12 14:24 . 2009-02-12 17:16        <DIR>        d--------        c:\programdata\BitDefender

2009-02-12 14:24 . 2009-02-12 14:24        <DIR>        d--------        c:\program files\BitDefender

2009-02-12 14:16 . 2009-02-12 14:24        <DIR>        d--------        c:\program files\Common Files\BitDefender

2009-02-12 03:03 . 2009-02-12 03:03        <DIR>        d--------        c:\windows\SQLTools9_KB960089_ENU

2009-02-12 03:00 . 2009-02-12 03:00        <DIR>        d--------        c:\windows\SQL9_KB960089_ENU

2009-02-11 17:49 . 2009-01-15 04:36        1,383,424        --a------        c:\windows\System32\mshtml.tlb

2009-02-11 17:49 . 2009-01-15 07:11        827,392        --a------        c:\windows\System32\wininet.dll

2009-02-07 17:43 . 2009-02-07 17:43        0        --a------        c:\users\***\AppData\Roaming\wklnhst.dat

2009-02-07 15:54 . 2009-02-07 15:54        0        --a------        c:\windows\tosOBEX.INI

2009-02-07 15:00 . 2009-02-07 15:00        <DIR>        d--------        c:\users\***\AppData\Roaming\MAGIX

2009-02-07 14:16 . 2009-02-09 05:07        <DIR>        d--------        c:\users\***\AppData\Roaming\BitTorrent

2009-02-06 20:27 . 2009-02-06 20:27        <DIR>        d--------        c:\users\***\AppData\Roaming\Apple Computer

2009-02-06 20:14 . 2009-02-06 20:14        <DIR>        d--------        c:\windows\System32\Plug-In Settings

2009-02-06 03:56 . 2008-06-26 02:45        12,240,896        --a------        c:\windows\System32\NlsLexicons0007.dll

2009-02-06 03:56 . 2008-06-26 02:45        2,644,480        --a------        c:\windows\System32\NlsLexicons0009.dll

2009-02-06 03:55 . 2008-06-26 04:29        801,280        --a------        c:\windows\System32\NaturalLanguage6.dll

2009-02-06 03:03 . 2009-02-06 03:03        <DIR>        d--------        c:\windows\SQLTools9_KB954606_ENU

2009-02-06 03:01 . 2009-02-06 03:01        <DIR>        d--------        c:\windows\SQL9_KB954606_ENU

2009-02-05 18:19 . 2008-11-01 02:21        4,240,384        --a------        c:\windows\System32\GameUXLegacyGDFs.dll

2009-02-05 18:19 . 2008-11-01 04:44        28,672        --a------        c:\windows\System32\Apphlpdm.dll

2009-02-05 18:02 . 2008-10-21 06:25        296,960        --a------        c:\windows\System32\gdi32.dll

2009-02-05 18:00 . 2008-06-19 04:31        361,984        --a------        c:\windows\System32\IPSECSVC.DLL

2009-02-05 18:00 . 2008-10-22 04:57        241,152        --a------        c:\windows\System32\PortableDeviceApi.dll

2009-02-05 17:57 . 2008-04-26 09:26        891,448        --a------        c:\windows\System32\drivers\tcpip.sys

2009-02-05 17:57 . 2008-04-12 04:32        784,896        --a------        c:\windows\System32\rpcrt4.dll

2009-02-05 17:57 . 2008-04-05 02:21        72,192        --a------        c:\windows\System32\drivers\pacer.sys

2009-02-05 17:57 . 2008-04-05 04:34        15,360        --a------        c:\windows\System32\pacerprf.dll

2009-02-05 17:51 . 2008-04-18 06:48        269,312        --a------        c:\windows\System32\es.dll

2009-02-05 17:51 . 2008-08-27 02:05        212,480        --a------        c:\windows\System32\drivers\mrxsmb10.sys

2009-02-05 17:50 . 2008-09-18 03:16        2,032,640        --a------        c:\windows\System32\win32k.sys

2009-02-05 17:50 . 2008-09-05 06:14        1,191,936        --a------        c:\windows\System32\msxml3.dll

2009-02-05 17:50 . 2008-06-26 04:29        303,616        --a------        c:\windows\System32\wmpeffects.dll

2009-02-05 17:33 . 2008-10-29 07:29        2,927,104        --a------        c:\windows\explorer.exe

2009-02-05 17:26 . 2008-09-18 06:09        3,601,464        --a------        c:\windows\System32\ntkrnlpa.exe

2009-02-05 17:26 . 2008-09-18 06:09        3,549,240        --a------        c:\windows\System32\ntoskrnl.exe

2009-02-05 17:26 . 2008-10-21 06:25        1,645,568        --a------        c:\windows\System32\connect.dll
 

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-02-17 19:26        65,096        ----a-w        c:\users\All Users\nvModes.dat

2009-02-17 19:26        65,096        ----a-w        c:\programdata\nvModes.dat

2009-02-14 16:27        ---------        d--h--w        c:\program files\InstallShield Installation Information

2009-02-14 16:18        ---------        d-----w        c:\program files\Microsoft Games

2009-02-13 11:14        ---------        d-----w        c:\program files\Common Files\Adobe

2009-02-12 16:51        242,184        ----a-w        c:\windows\system32\drivers\bdfsfltr.sys

2009-02-12 16:51        192,512        ----a-w        c:\windows\System32\txmlutil.dll

2009-02-12 16:51        104,328        ----a-w        c:\windows\system32\drivers\bdfndisf.sys

2009-02-12 16:05        ---------        d-----w        c:\program files\Common Files\Wise Installation Wizard

2009-02-12 02:00        ---------        d-----w        c:\program files\Windows Mail

2009-02-06 04:34        ---------        d-----w        c:\programdata\Microsoft Help

2009-02-04 17:39        ---------        d-----w        c:\programdata\McAfee

2009-02-03 21:57        ---------        d-----w        c:\program files\Google

2009-02-03 20:10        ---------        d-----w        c:\programdata\NVIDIA

2009-02-03 20:08        ---------        d-----w        c:\program files\Common Files\InstallShield

2009-02-03 19:59        ---------        d-sh--w        c:\programdata\Vorlagen

2009-02-03 19:59        ---------        d-sh--w        c:\programdata\Startmenü

2009-02-03 19:59        ---------        d-sh--w        c:\programdata\Favoriten

2009-02-03 19:59        ---------        d-sh--w        c:\programdata\Dokumente

2009-02-03 19:59        ---------        d-sh--w        c:\programdata\Anwendungsdaten

2009-02-03 19:59        ---------        d-sh--w        c:\program files\Gemeinsame Dateien

2009-02-03 18:55        ---------        d-----w        c:\program files\Toshiba

2009-02-03 18:53        ---------        d-----w        c:\program files\Common Files\Toshiba Shared

2009-02-03 18:51        ---------        d-----w        c:\program files\Microsoft.NET

2009-02-03 18:50        ---------        d-----w        c:\programdata\Toshiba

2009-02-03 18:44        ---------        d-----w        c:\program files\Intel

2008-11-24 21:31        65,888        ----a-w        c:\windows\System32\sqlctr90.dll

2008-11-24 21:31        2,248,544        ----a-w        c:\windows\System32\sqlncli.dll

2008-01-21 02:43        174        --sha-w        c:\program files\desktop.ini

.
 

(((((((((((((((((((((((((((((   SnapShot@2009-02-17_13.56.37.17   )))))))))))))))))))))))))))))))))))))))))

.

- 2009-02-17 12:47:08        919,448        ----a-w        c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat

+ 2009-02-17 13:30:35        919,448        ----a-w        c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat

- 2009-02-17 12:51:59        2,048        --sha-w        c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat

+ 2009-02-17 19:23:48        2,048        --sha-w        c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat

- 2009-02-17 12:51:59        2,048        --sha-w        c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat

+ 2009-02-17 19:23:48        2,048        --sha-w        c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat

- 2009-02-17 12:54:13        262,144        --sha-w        c:\windows\ServiceProfiles\LocalService\NTUSER.DAT

+ 2009-02-17 19:26:43        262,144        --sha-w        c:\windows\ServiceProfiles\LocalService\NTUSER.DAT

+ 2009-02-17 19:26:43        262,144        ---ha-w        c:\windows\ServiceProfiles\LocalService\ntuser.dat.LOG1

- 2009-02-17 12:54:08        262,144        --sha-w        c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT

+ 2009-02-17 19:26:48        262,144        --sha-w        c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT

+ 2009-02-17 19:26:48        262,144        ---ha-w        c:\windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1

- 2009-02-17 12:35:52        16,384        --sha-w        c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

+ 2009-02-17 19:32:30        16,384        --sha-w        c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

- 2009-02-17 12:35:52        32,768        --sha-w        c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

+ 2009-02-17 19:32:30        32,768        --sha-w        c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

- 2009-02-17 12:35:52        32,768        --sha-w        c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

+ 2009-02-17 19:32:30        32,768        --sha-w        c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

- 2009-02-17 12:43:22        140,844        ----a-w        c:\windows\System32\perfc007.dat

+ 2009-02-17 19:29:56        140,844        ----a-w        c:\windows\System32\perfc007.dat

- 2009-02-17 12:43:22        119,252        ----a-w        c:\windows\System32\perfc009.dat

+ 2009-02-17 19:29:56        119,252        ----a-w        c:\windows\System32\perfc009.dat

- 2009-02-17 12:43:22        665,150        ----a-w        c:\windows\System32\perfh007.dat

+ 2009-02-17 19:29:56        665,150        ----a-w        c:\windows\System32\perfh007.dat

- 2009-02-17 12:43:23        633,886        ----a-w        c:\windows\System32\perfh009.dat

+ 2009-02-17 19:29:56        633,886        ----a-w        c:\windows\System32\perfh009.dat

- 2009-02-17 12:38:05        4,496        ----a-w        c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3248546604-1487097281-3100174776-1004_UserData.bin

+ 2009-02-17 19:27:44        4,854        ----a-w        c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3248546604-1487097281-3100174776-1004_UserData.bin

- 2009-02-17 12:38:05        94,164        ----a-w        c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin

+ 2009-02-17 19:27:44        94,730        ----a-w        c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin

- 2009-02-17 12:38:03        55,224        ----a-w        c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin

+ 2009-02-17 19:27:43        55,248        ----a-w        c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin

.

-- Snapshot auf jetziges Datum zurückgesetzt --

jackaces

17.02.2009 20:54

Teil II

Code:



.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\IconOvrly1]

@="{A4EEBF66-92EB-4F2A-9F1E-2F6D14B30DA6}"

[HKEY_CLASSES_ROOT\CLSID\{A4EEBF66-92EB-4F2A-9F1E-2F6D14B30DA6}]

2007-04-20 11:40        118784        --a------        c:\program files\TrueSuite Access Manager\IconOvrly.dll 
 

c:\users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-07 101440]
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

"DisableCAD"= 1 (0x1)
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"msacm.dvacm"= c:\progra~1\COMMON~1\ULEADS~1\vio\dvacm.acm
 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"WMPNSCFG"=c:\program files\Windows Media Player\WMPNSCFG.exe

"BitTorrent DNA"="c:\users\***\Program Files\DNA\btdna.exe"

"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray

"ehTray.exe"=c:\windows\ehome\ehTray.exe

"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" -autorun
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_06\bin\jusched.exe"

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

"Toshiba Registration"=c:\program files\Toshiba\Registration\ToshibaRegistration.exe

"Google EULA Launcher"=c:\program files\Google\Google EULA\GoogleEULALauncher.exe IE PA

"UsbMonitor"="c:\program files\TrueSuite Access Manager\usbnotify.exe"

"TRCMan"=c:\program files\TOSHIBA\TRCMan\TRCMan.exe

"Toshiba TEMPO"=c:\program files\Toshiba TEMPRO\Toshiba.Tempo.UI.TrayApplication.exe

"TPwrMain"=%ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE

"00TCrdMain"=%ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe

"SmoothView"=%ProgramFiles%\Toshiba\SmoothView\SmoothView.exe

"PwdBank"="c:\program files\TrueSuite Access Manager\PwdBank.exe"

"topi"=c:\program files\TOSHIBA\Toshiba Online Product Information\topi.exe -startup

"NvMediaCenter"=RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit

"KeNotify"=c:\program files\TOSHIBA\Utilities\KeNotify.exe

"HSON"=%ProgramFiles%\TOSHIBA\TBS\HSON.exe

"HDMICtrlMan"=c:\program files\TOSHIBA\HDMICtrlMan\HDMICtrlMan.exe

"FingerPrintNotifer"="c:\program files\TrueSuite Access Manager\FpNotifier.exe"

"NDSTray.exe"=NDSTray.exe

"cfFncEnabler.exe"=cfFncEnabler.exe

"Camera Assistant Software"="c:\program files\Camera Assistant Software for Toshiba\traybar.exe" /start

"BDAgent"="c:\program files\BitDefender\BitDefender 2009\bdagent.exe"

"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]

"DisableMonitoring"=dword:00000001
 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]

"{0D5A11D8-E422-4A43-ABDE-BA756967A541}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote

"{9A221C51-2180-4732-B874-696FDFB680E8}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote

"{934620BD-DE55-4E76-85CE-DA322E48CC52}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour

"{57B0FD66-B15E-4BCE-A858-7465A2DFCD76}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour

"{506F4A8F-1D3F-41D8-B90F-54F11BBDC9AA}"= UDP:c:\program files\DNA\btdna.exe:DNA (TCP-In)

"{7B34D169-B9E2-4D37-9FAA-78EAA3E943F8}"= TCP:c:\program files\DNA\btdna.exe:DNA (UDP-In)

"{73AC1D2B-3CFF-406D-8405-10FE7CF41864}"= UDP:e:\programme\BitTorrent\BitTorrent.exe:BitTorrent (TCP-In)

"{D089E315-992E-44AE-B3E1-15F67641305C}"= TCP:e:\programme\BitTorrent\BitTorrent.exe:BitTorrent (UDP-In)

"TCP Query User{FBCC3FB5-6BFC-40E6-86DF-E827108373D6}e:\\programme\\bittorrent\\bittorrent.exe"= UDP:e:\programme\bittorrent\bittorrent.exe:BitTorrent

"UDP Query User{BA022530-DA15-4DC7-AAAB-209AD71A0924}e:\\programme\\bittorrent\\bittorrent.exe"= TCP:e:\programme\bittorrent\bittorrent.exe:BitTorrent

"TCP Query User{0E666614-4E97-4509-BA10-4F7CD3FEDB10}c:\\program files\\dna\\btdna.exe"= UDP:c:\program files\dna\btdna.exe:DNA

"UDP Query User{85AB0218-36F5-4C86-8DB7-E282A0BC4811}c:\\program files\\dna\\btdna.exe"= TCP:c:\program files\dna\btdna.exe:DNA

"{5CCB0DE4-81BE-4A42-B9B0-81FCF2AF96D5}"= UDP:5353:Adobe CSI CS4

"{A0294B2E-C955-45EF-835B-274045B0A5E5}"= UDP:c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:Adobe CSI CS4

"{2483256D-3EB6-4F0B-B5BB-BE4C2571DD40}"= TCP:c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:Adobe CSI CS4
 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]

"e:\\Programme\\BitTorrent\\bittorrent.exe"= e:\programme\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent
 

R0 AlfaFF;AlfaFF mini-filter driver;c:\windows\System32\drivers\AlfaFF.sys [2009-02-03 42608]

R2 Authentec memory manager;Authentec memory manager service;c:\windows\System32\TAMSvr.exe [2009-02-03 49152]

R2 BDVEDISK;BDVEDISK;c:\program files\BitDefender\BitDefender 2009\BDVEDISK.sys [2008-07-02 82696]

R2 ConfigFree Service;ConfigFree Service;c:\program files\Toshiba\ConfigFree\CFSvcs.exe [2008-04-16 40960]

R2 MSSQL$QOSMIOAVINDEXING;SQL Server (QOSMIOAVINDEXING);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2008-11-24 29263712]

R2 TempoMonitoringService;Notebook Performance Tuning Service ;c:\program files\Toshiba TEMPRO\TempoSVC.exe [2008-04-24 99720]

R2 TOSHIBA SMART Log Service;TOSHIBA SMART Log Service;c:\program files\Toshiba\SMARTLogService\TosIPCSrv.exe [2007-12-03 126976]

R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\System32\TUProgSt.exe [2009-02-13 603904]

R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;c:\windows\System32\drivers\bdfndisf.sys [2008-08-14 104328]

R3 enecir;ENE CIR Receiver;c:\windows\System32\drivers\enecir.sys [2008-07-07 54784]

R3 enecirhid;ENE CIR HID Receiver;c:\windows\System32\drivers\enecirhid.sys [2008-07-07 11264]

R3 enecirhidma;ENE CIR HIDmini Filter;c:\windows\System32\drivers\enecirhidma.sys [2008-07-07 5632]

R3 JMCR;JMCR;c:\windows\System32\drivers\jmcr.sys [2008-07-07 86672]

R3 NETw5v32;Intel(R) Wireless WiFi Link Adaptertreiber für Windows Vista 32-Bit;c:\windows\System32\drivers\NETw5v32.sys [2008-07-07 3658752]

R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\System32\drivers\nvhda32v.sys [2008-07-07 43040]

R3 SmartFaceVWatchSrv;SmartFaceVWatchSrv;c:\program files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe [2008-04-24 73728]

R3 SPURS;TOSHIBA Quad Core HD Processor;c:\windows\System32\drivers\spurs.sys [2008-05-07 106496]

S3 Arrakis3;BitDefender Arrakis Server;c:\program files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe [2008-07-17 118784]

S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\MAGIX\Common\Database\bin\fbserver.exe [2008-07-07 1527900]

S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2009-02-15 356920]
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

bdx        REG_MULTI_SZ           scan
 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs

UxTuneUp
 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9647d6ab-fab1-11dd-baa3-00037a95202a}]

\shell\AutoRun\command - G:\autorun.exe

\shell\directx\command - g:\directx9\dxsetup.exe

\shell\setup\command - G:\setup.exe

.

Inhalt des "geplante Tasks" Ordners
 

2009-02-17 c:\windows\Tasks\1-Klick-Wartung.job

- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2008-12-11 19:07]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.google.de/

mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSEA&bmod=TSEA

uInternet Settings,ProxyOverride = *.local

IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000

IE: {{76577871-04EC-495E-A12B-91F7C3600AFA} - http://rover.ebay.com/rover/1/707-44556-9400-3/4

IE: {{8A918C1D-E123-4E36-B562-5C1519E434CE} - http://www.amazon.de/exec/obidos/redirect-home?tag=Toshibadebholink-21&site=home

.
 

**************************************************************************
 

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-02-17 20:41:23

Windows 6.0.6001 Service Pack 1 NTFS
 

Scanne versteckte Prozesse... 
 

Scanne versteckte Autostarteinträge... 
 

Scanne versteckte Dateien... 
 

Scan erfolgreich abgeschlossen

versteckte Dateien: 0
 

**************************************************************************

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
 

- - - - - - - > 'Explorer.exe'(5168)

c:\program files\TrueSuite Access Manager\IconOvrly.dll

.

Zeit der Fertigstellung: 2009-02-17 20:42:42

ComboFix-quarantined-files.txt  2009-02-17 19:42:38

ComboFix2.txt  2009-02-17 12:57:20
 

Vor Suchlauf: 17 Verzeichnis(se), 87.091.924.992 Bytes frei

Nach Suchlauf: 17 Verzeichnis(se), 87,052,558,336 Bytes frei
 

332        --- E O F ---        2009-02-16 18:31:05

Redwulf

17.02.2009 23:11

Hmm, für mich hört sich das an als ob du nen DNSChanger drin hast. Die Google sympthome deuten daraufhin. Schau doch bitte mal in deine netzwerkverbindung. Rechtsklick auf deine Internetverbindung / Eigenschaften / suche den Eintrag TCP/IP, markiere ihn und drücke Eigenschaften. Letzte Einträge, beziehst du deine DNS automatisch oder stehen da IP Nummern beginnend mit 85.255.XXX.XXX ?

Ich seh grad: Du hast Bitdefender drauf, kann sein das Teile dieses Viruses schon eliminiert wurden und somit keinerlei IP im DNS autaucht. vergewissere dich das DNS beziehen auf automatisch zieht. Ich schalge vor du lässt mal Gmer laufen und postest das Logfile. Schaun wir mal.

Redwulf

17.02.2009 23:22

Gmer gibts hier:

http://www.gmer.net/gmer.zip

Einach laufen lassen und wenn er meckert den Scan machen lassen. Den Log hier posten...

jackaces

17.02.2009 23:39

Zitat:

Letzte Einträge, beziehst du deine DNS automatisch oder stehen da IP Nummern beginnend mit 85.255.XXX.XXX ?

es steht auf automatisch beziehen (bei IPv6 und auch bei IPv4)

Zitat:

Du hast Bitdefender drauf, kann sein das Teile dieses Viruses schon eliminiert wurden und somit keinerlei IP im DNS autaucht. vergewissere dich das DNS beziehen auf automatisch zieht.

ich habe es nach einer der anleitungen diese forums mit malwarebytes' Anti-Malware probiert und es wurde mir zu vertsehen gegeben, dass ich Trojan.Vundo.H (in 7 verschx. Objekten) in der Quarantäne habe.

Der Log von gmer kommt sofort im anschluss

jackaces

17.02.2009 23:51

sollte ich vllt den Bitdefender beim Durchlauf von GMER ausschalten?

Code:

GMER 1.0.14.14536 - http://www.gmer.net

Rootkit scan 2009-02-17 23:47:29

Windows 6.0.6001 Service Pack 1
 
 

---- System - GMER 1.0.14 ----
 

SSDT            \??\C:\Program Files\BitDefender\BitDefender 2009\bdselfpr.sys                                                            ZwOpenProcess [0xA8045BCE]

SSDT            \??\C:\Program Files\BitDefender\BitDefender 2009\bdselfpr.sys                                                            ZwOpenThread [0xA8045CBC]

SSDT            \??\C:\Program Files\BitDefender\BitDefender 2009\bdselfpr.sys                                                            ZwTerminateProcess [0xA8045B32]
 

INT 0x51        ?                                                                                                                         87621BF8

INT 0x62        ?                                                                                                                         87621BF8

INT 0x72        ?                                                                                                                         87621BF8

INT 0x92        ?                                                                                                                         8592BBF8

INT 0x92        ?                                                                                                                         87621BF8

INT 0x92        ?                                                                                                                         87621BF8

INT 0x92        ?                                                                                                                         87621BF8

INT 0x92        ?                                                                                                                         8592BBF8

INT 0xB2        ?                                                                                                                         84F98BF8

INT 0xB2        ?                                                                                                                         84F98BF8

INT 0xB2        ?                                                                                                                         84F98BF8

INT 0xB2        ?                                                                                                                         84F98BF8
 

---- Kernel code sections - GMER 1.0.14 ----
 

.text           ntkrnlpa.exe!KeSetTimerEx + 624                                                                                           82105BE8 4 Bytes  [ CE, 5B, 04, A8 ]

.text           ntkrnlpa.exe!KeSetTimerEx + 640                                                                                           82105C04 4 Bytes  [ BC, 5C, 04, A8 ]

.text           ntkrnlpa.exe!KeSetTimerEx + 854                                                                                           82105E18 4 Bytes  [ 32, 5B, 04, A8 ]

?               System32\Drivers\splq.sys                                                                                                 Das System kann die angegebene Datei nicht finden. !

.text           USBPORT.SYS!DllUnload                                                                                                     8E11346F 5 Bytes  JMP 876211D8 

.text           a4cspnj6.SYS                                                                                                              8E1B8000 22 Bytes  [ 26, 12, 02, 82, 10, 11, 02, ... ]

.text           a4cspnj6.SYS                                                                                                              8E1B8017 126 Bytes  [ 00, 32, E7, 79, 80, 3D, E5, ... ]

.text           a4cspnj6.SYS                                                                                                              8E1B8096 18 Bytes  [ 0A, 82, 44, 13, 0A, 82, 9C, ... ]

.text           a4cspnj6.SYS                                                                                                              8E1B80A9 35 Bytes  [ 00, 0A, 82, A0, F7, 09, 82, ... ]

.text           a4cspnj6.SYS                                                                                                              8E1B80CE 10 Bytes  [ 00, 00, 00, 00, 00, 00, 66, ... ]

.text           ...                                                                                                                       

?               C:\Windows\system32\Drivers\PROCEXP90.SYS                                                                                 Das System kann die angegebene Datei nicht finden. !

?               C:\ComboFix\catchme.sys                                                                                                   Das System kann die angegebene Datei nicht finden. !
 

---- User code sections - GMER 1.0.14 ----
 

.text           C:\Program Files\Internet Explorer\iexplore.exe[5076] USER32.dll!DialogBoxIndirectParamW                                  75D4BD25 5 Bytes  JMP 6ADA5CBB C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[5076] USER32.dll!DialogBoxParamW                                          75D61FD5 5 Bytes  JMP 6ADA5C45 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[5076] USER32.dll!DialogBoxParamA                                          75D880B2 5 Bytes  JMP 6ADA5C80 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[5076] USER32.dll!DialogBoxIndirectParamA                                  75D883DD 5 Bytes  JMP 6ADA5CF6 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[5076] USER32.dll!MessageBoxIndirectA                                      75D9D471 5 Bytes  JMP 6ADA5C01 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[5076] USER32.dll!MessageBoxIndirectW                                      75D9D56B 5 Bytes  JMP 6ADA5BBD C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[5076] USER32.dll!MessageBoxExA                                            75D9D5D1 5 Bytes  JMP 6ADA5B83 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text           C:\Program Files\Internet Explorer\iexplore.exe[5076] USER32.dll!MessageBoxExW                                            75D9D5F5 5 Bytes  JMP 6ADA5B49 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
 

---- Kernel IAT/EAT - GMER 1.0.14 ----
 

IAT             \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortUchar]                                                 [806956D2] \SystemRoot\System32\Drivers\splq.sys

IAT             \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortUchar]                                                  [80695040] \SystemRoot\System32\Drivers\splq.sys

IAT             \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortBufferUshort]                                          [806957FC] \SystemRoot\System32\Drivers\splq.sys

IAT             \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortUshort]                                                 [806950BE] \SystemRoot\System32\Drivers\splq.sys

IAT             \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortBufferUshort]                                           [8069513C] \SystemRoot\System32\Drivers\splq.sys

IAT             \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR]                                                        [806A5048] \SystemRoot\System32\Drivers\splq.sys

IAT             \SystemRoot\System32\Drivers\a4cspnj6.SYS[ataport.SYS!AtaPortNotification]                                                24488B66

IAT             \SystemRoot\System32\Drivers\a4cspnj6.SYS[ataport.SYS!AtaPortWritePortUchar]                                              E84D8966

IAT             \SystemRoot\System32\Drivers\a4cspnj6.SYS[ataport.SYS!AtaPortWritePortUlong]                                              83E84D8B

IAT             \SystemRoot\System32\Drivers\a4cspnj6.SYS[ataport.SYS!AtaPortGetPhysicalAddress]                                          896602C1

IAT             \SystemRoot\System32\Drivers\a4cspnj6.SYS[ataport.SYS!AtaPortConvertPhysicalAddressToUlong]                               488BEA4D

IAT             \SystemRoot\System32\Drivers\a4cspnj6.SYS[ataport.SYS!AtaPortGetScatterGatherList]                                        8DC80320

IAT             \SystemRoot\System32\Drivers\a4cspnj6.SYS[ataport.SYS!AtaPortReadPortUchar]                                               57500845

IAT             \SystemRoot\System32\Drivers\a4cspnj6.SYS[ataport.SYS!AtaPortStallExecution]                                              F0458D57

IAT             \SystemRoot\System32\Drivers\a4cspnj6.SYS[ataport.SYS!AtaPortGetParentBusType]                                            00006850

IAT             \SystemRoot\System32\Drivers\a4cspnj6.SYS[ataport.SYS!AtaPortRequestCallback]                                             458DB002

IAT             \SystemRoot\System32\Drivers\a4cspnj6.SYS[ataport.SYS!AtaPortWritePortBufferUshort]                                       35FF50E8

IAT             \SystemRoot\System32\Drivers\a4cspnj6.SYS[ataport.SYS!AtaPortGetUnCachedExtension]                                        [8E1DDFBC] \SystemRoot\System32\Drivers\a4cspnj6.SYS (ATAPI IDE Miniport Driver/Microsoft Corporation)

IAT             \SystemRoot\System32\Drivers\a4cspnj6.SYS[ataport.SYS!AtaPortCompleteRequest]                                             57EC4D89

IAT             \SystemRoot\System32\Drivers\a4cspnj6.SYS[ataport.SYS!AtaPortMoveMemory]                                                  01F045C7

IAT             \SystemRoot\System32\Drivers\a4cspnj6.SYS[ataport.SYS!AtaPortCompleteAllActiveRequests]                                   E8000000

IAT             \SystemRoot\System32\Drivers\a4cspnj6.SYS[ataport.SYS!AtaPortReleaseRequestSenseIrb]                                      0001E4E4

IAT             \SystemRoot\System32\Drivers\a4cspnj6.SYS[ataport.SYS!AtaPortBuildRequestSenseIrb]                                        4675C73B

IAT             \SystemRoot\System32\Drivers\a4cspnj6.SYS[ataport.SYS!AtaPortReadPortUshort]                                              1DDFC8A1

IAT             \SystemRoot\System32\Drivers\a4cspnj6.SYS[ataport.SYS!AtaPortReadPortBufferUshort]                                        8D526A8E

IAT             \SystemRoot\System32\Drivers\a4cspnj6.SYS[ataport.SYS!AtaPortInitialize]                                                  00009A88

IAT             \SystemRoot\System32\Drivers\a4cspnj6.SYS[ataport.SYS!AtaPortGetDeviceBase]                                               48C08300

IAT             \SystemRoot\System32\Drivers\a4cspnj6.SYS[ataport.SYS!AtaPortDeviceStateChange]                                           8D076A50
 

---- Devices - GMER 1.0.14 ----
 

Device          \FileSystem\Ntfs \Ntfs                                                                                                    8592E1F8

Device          \Driver\netbt \Device\NetBT_Tcpip_{89C9DCF9-D0E8-4EC4-94A5-BC79A9B6D0BB}                                                  91141380

Device          \Driver\volmgr \Device\VolMgrControl                                                                                      84F9B1F8

Device          \Driver\usbuhci \Device\USBPDO-0                                                                                          877331F8

Device          \Driver\usbuhci \Device\USBPDO-1                                                                                          877331F8

Device          \Driver\usbuhci \Device\USBPDO-2                                                                                          877331F8

Device          \Driver\usbehci \Device\USBPDO-3                                                                                          877351F8

Device          \Driver\usbuhci \Device\USBPDO-4                                                                                          877331F8
 

AttachedDevice  \Driver\tdx \Device\Tcp                                                                                                   bdftdif.sys
 

Device          \Driver\usbuhci \Device\USBPDO-5                                                                                          877331F8

Device          \Driver\usbuhci \Device\USBPDO-6                                                                                          877331F8

Device          \Driver\volmgr \Device\HarddiskVolume1                                                                                    84F9B1F8

Device          \Driver\usbehci \Device\USBPDO-7                                                                                          877351F8

Device          \Driver\volmgr \Device\HarddiskVolume2                                                                                    84F9B1F8

Device          \Driver\cdrom \Device\CdRom0                                                                                              877F31F8

Device          \Driver\volmgr \Device\HarddiskVolume3                                                                                    84F9B1F8

Device          \Driver\cdrom \Device\CdRom1                                                                                              877F31F8

Device          \Driver\volmgr \Device\HarddiskVolume4                                                                                    84F9B1F8

Device          \Driver\netbt \Device\NetBt_Wins_Export                                                                                   91141380

Device          \Driver\Smb \Device\NetbiosSmb                                                                                            9113B1F8

Device          \Driver\PCI_PNP8172 \Device\0000005a                                                                                      splq.sys

Device          \Driver\netbt \Device\NetBT_Tcpip_{8A8C9C6C-B5AD-454C-AE28-E1F751E3B604}                                                  91141380

Device          \Driver\iScsiPrt \Device\RaidPort0                                                                                        878161F8

Device          \Driver\sptd \Device\818576190                                                                                            splq.sys
 

AttachedDevice  \Driver\tdx \Device\Udp                                                                                                   bdftdif.sys
 

Device          \Driver\usbuhci \Device\USBFDO-0                                                                                          877331F8

Device          \Driver\usbuhci \Device\USBFDO-1                                                                                          877331F8

Device          \Driver\usbuhci \Device\USBFDO-2                                                                                          877331F8

Device          \Driver\netbt \Device\NetBT_Tcpip_{A80952E6-AE6E-4BE2-90DB-AE1ADD7DFC3E}                                                  91141380

Device          \Driver\usbehci \Device\USBFDO-3                                                                                          877351F8

Device          \Driver\usbuhci \Device\USBFDO-4                                                                                          877331F8

Device          \Driver\usbuhci \Device\USBFDO-5                                                                                          877331F8

Device          \Driver\usbuhci \Device\USBFDO-6                                                                                          877331F8

Device          \Driver\usbehci \Device\USBFDO-7                                                                                          877351F8

Device          \Driver\a4cspnj6 \Device\Scsi\a4cspnj61Port6Path0Target0Lun0                                                              878061F8

Device          \Driver\a4cspnj6 \Device\Scsi\a4cspnj61                                                                                   878061F8

Device          \Driver\JMCR \Device\Scsi\JMCR1                                                                                           877DF500

Device          \Driver\JMCR \Device\Scsi\JMCR2                                                                                           877DF500

Device          \Driver\JMCR \Device\Scsi\JMCR3                                                                                           877DF500

Device          \Driver\JMCR \Device\Scsi\JMCR4                                                                                           877DF500

Device          \FileSystem\cdfs \Cdfs                                                                                                    853FE1F8
 

---- Registry - GMER 1.0.14 ----
 

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1                                                                        771343423

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2                                                                        285507792

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0                                                                        1

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4                                          

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0                                       C:\Program Files\DAEMON Tools Lite\

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                       0

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                                    0xAB 0x3C 0x18 0x30 ...

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001                                 

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0                              0x20 0x01 0x00 0x00 ...

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh                           0x00 0xD2 0x8E 0xD2 ...

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40                           

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh                     0x76 0x11 0x97 0xFC ...

Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4                                              

Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0                                           C:\Program Files\DAEMON Tools Lite\

Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                           0

Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                                        0xAB 0x3C 0x18 0x30 ...

Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001                                     

Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0                                  0x20 0x01 0x00 0x00 ...

Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh                               0x00 0xD2 0x8E 0xD2 ...

Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40                               

Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh                         0x76 0x11 0x97 0xFC ...
 

---- Files - GMER 1.0.14 ----
 

File            C:\Users\***\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FFE410SE\errorPageStrings[1]   978 bytes

File            C:\Users\***\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FFE410SE\ErrorPageTemplate[2]  2168 bytes
 

---- EOF - GMER 1.0.14 ----

Redwulf

18.02.2009 04:10

Hallo aces
Soweit so gut. Ich kann kein Rootkit erkennen Über entsprechende Einträge verfügt der Gmer Log NICHT. Ich denke der Großteil der Arbeit ist gemacht, möchte aber hier chris4you nicht weiter in die Parade fahren. Ich denke er hat schon eine Strategie die dein system retten wird.... Ich drück die Daumen

Chris4You

18.02.2009 08:46

Hi,

Du hast sehr viele neue Files/Programme auf dem Rechner,
das macht die Sache etwas "unübersichtlich"...

Bitte folgende Files prüfen:

Dateien Online überprüfen lassen:

Als erstes versteckte Dateien anzeigen lassen! (nur Punkt 1 durchführen!)

Suche die Seite Virtustotal auf, klicke auf den Button „Durchsuchen“ und suche folgende Datei/Dateien:

Code:

c:\windows\System32\xa68148085.exe

c:\windows\System32\xa68147897.exe

c:\windows\System32\bdod.bin (Bitdefender?)

c:\windows\System32\wininet.dll (kürzlich geändert worden...)

c:\windows\System32\drivers\jmcr.sys

c:\windows\System32\Drivers\splq.sys 

c:\windows\System32\Drivers\a4cspnj6.SYS

c:\program files\TrueSuite Access Manager\IconOvrly.dll

Lade nun nacheinander jede/alle Datei/Dateien hoch, und warte bis der Scan vorbei ist. (kann bis zu 2 Minuten dauern.)

Poste im Anschluss das Ergebnis der Auswertung, alles abkopieren und in einen Beitrag einfügen.

Wichtig: Auch die Größenangabe sowie den HASH mit kopieren!

Du hast in dem Mountpoint einige autoruns drin, gewollt?
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9647d6ab-fab1-11dd-baa3-00037a95202a}]
\shell\AutoRun\command - G:\autorun.exe
\shell\directx\command - g:\directx9\dxsetup.exe
\shell\setup\command - G:\setup.exe
Sonst per Regedit die Schlüssel löschen...

Wirst Du noch umgeleitet?

chris

jackaces

19.02.2009 03:23

Zitat:

c:\windows\System32\xa68148085.exe

Code:



a-squared 4.0.0.93 2009.02.19 Riskware.Keygen.Adobe!IK

eSafe 7.0.17.0 2009.02.18 Win32.TrojanHorse

Ikarus T3.1.1.45.0 2009.02.19 not-a-Virus.Keygen.Adobe 

McAfee 5529 2009.02.17 Generic.dx 

McAfee+Artemis 5529 2009.02.17 Generic.dx 

Panda 9.4.3.20 2009.02.18 Generic Malware 

Prevx1 V2 2009.02.19 High Risk Worm 

TrendMicro 8.700.0.1004 2009.02.18 PAK_Generic.001 
 

weitere Informationen 

File size: 73728 bytes 

MD5...: 86c5405a9226040aca68f073bbc5c0a0 

SHA1..: 3961bfbe968287b9e4792bd6dee3f89b7290886d 

SHA256: 1371f04463778e441b97bc6cbd6b7cb4569c5ad311dcc36698b3602b07f9ea51 

SHA512: 1a8a1eefd2c7f3037b4fd28745d4964f13953e0f3c0b16143b08fb7401a7f01f

fb0d42b3ae9928a9d0f56a5e1772c8861585f01883b271387eb0184f7f680992 

ssdeep: 1536:0RbLGsaCh7/W2qbRlL357HWfGy6QIQktG5qYU+RIIwdG1oD:0NVZ/W2wyIQ

kM5Q+RIJG1

 

PEiD..: UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser 

TrID..: File type identification

Win32 EXE Yoda's Crypter (54.4%)

Win32 Executable Generic (17.4%)

Win32 Dynamic Link Library (generic) (15.5%)

Win16/32 Executable Delphi generic (4.2%)

Generic Win/DOS Executable (4.1%) 

PEInfo: PE Structure information
 

( base data )

entrypointaddress.: 0x497520

timedatestamp.....: 0x8d6a5b5aL (invalid)

machinetype.......: 0x14c (I386)
 

( 3 sections )

name viradd virsiz rawdsiz ntrpy md5

UPX0 0x1000 0x86000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e

UPX1 0x87000 0x11000 0x10800 7.88 b0bfd38e18402ebc2e8303836abd9fd4

.rsrc 0x98000 0x1000 0xa00 3.10 779e1f5c9585bb0314ef9e697c746520
 

( 5 imports ) 

> KERNEL32.DLL: LoadLibraryA, GetProcAddress, ExitProcess

> DSOUND.dll: DirectSoundCreate

> GDI32.dll: BitBlt

> SHELL32.DLL: Shell_NotifyIcon

> USER32.dll: GetDC
 

( 0 exports ) 

 

packers (Kaspersky): UPX 

ThreatExpert info: <a href='http://www.threatexpert.com/report.aspx?md5=86c5405a9226040aca68f073bbc5c0a0' target='_blank'>http://www.threatexpert.com/report.aspx?md5=86c5405a9226040aca68f073bbc5c0a0</a> 

Prevx info: <a href='http://info.prevx.com/aboutprogramtext.asp?PX5=4C8FB7260047DAC0207D01DEE53C1B001ACAC2BE' target='_blank'>http://info.prevx.com/aboutprogramtext.asp?PX5=4C8FB7260047DAC0207D01DEE53C1B001ACAC2BE</a> 

packers (F-Prot): UPX 

CWSandbox info: <a href='http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=86c5405a9226040aca68f073bbc5c0a0' target='_blank'>http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=86c5405a9226040aca68f073bbc5c0a0</a>

Zitat:

c:\windows\System32\xa68147897.exe

Code:



a-squared 4.0.0.93 2009.02.19 Riskware.Keygen.Adobe!IK 

eSafe 7.0.17.0 2009.02.18 Win32.TrojanHorse 

Ikarus T3.1.1.45.0 2009.02.19 not-a-Virus.Keygen.Adobe 

McAfee 5529 2009.02.17 Generic.dx 

McAfee+Artemis 5529 2009.02.17 Generic.dx

Panda 9.4.3.20 2009.02.18 Generic Malware 

Prevx1 V2 2009.02.19 High Risk Worm 

TrendMicro 8.700.0.1004 2009.02.18 PAK_Generic.001 
 

weitere Informationen 

File size: 73728 bytes 

MD5...: 86c5405a9226040aca68f073bbc5c0a0 

SHA1..: 3961bfbe968287b9e4792bd6dee3f89b7290886d 

SHA256: 1371f04463778e441b97bc6cbd6b7cb4569c5ad311dcc36698b3602b07f9ea51 

SHA512: 1a8a1eefd2c7f3037b4fd28745d4964f13953e0f3c0b16143b08fb7401a7f01f

fb0d42b3ae9928a9d0f56a5e1772c8861585f01883b271387eb0184f7f680992 

ssdeep: 1536:0RbLGsaCh7/W2qbRlL357HWfGy6QIQktG5qYU+RIIwdG1oD:0NVZ/W2wyIQ

kM5Q+RIJG1

 

PEiD..: UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser 

TrID..: File type identification

Win32 EXE Yoda's Crypter (54.4%)

Win32 Executable Generic (17.4%)

Win32 Dynamic Link Library (generic) (15.5%)

Win16/32 Executable Delphi generic (4.2%)

Generic Win/DOS Executable (4.1%) 

PEInfo: PE Structure information
 

( base data )

entrypointaddress.: 0x497520

timedatestamp.....: 0x8d6a5b5aL (invalid)

machinetype.......: 0x14c (I386)
 

( 3 sections )

name viradd virsiz rawdsiz ntrpy md5

UPX0 0x1000 0x86000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e

UPX1 0x87000 0x11000 0x10800 7.88 b0bfd38e18402ebc2e8303836abd9fd4

.rsrc 0x98000 0x1000 0xa00 3.10 779e1f5c9585bb0314ef9e697c746520
 

( 5 imports ) 

> KERNEL32.DLL: LoadLibraryA, GetProcAddress, ExitProcess

> DSOUND.dll: DirectSoundCreate

> GDI32.dll: BitBlt

> SHELL32.DLL: Shell_NotifyIcon

> USER32.dll: GetDC
 

( 0 exports ) 

 

Prevx info: <a href='http://info.prevx.com/aboutprogramtext.asp?PX5=4C8FB7260047DAC0207D01DEE53C1B001ACAC2BE' target='_blank'>http://info.prevx.com/aboutprogramtext.asp?PX5=4C8FB7260047DAC0207D01DEE53C1B001ACAC2BE</a> 

ThreatExpert info: <a href='http://www.threatexpert.com/report.aspx?md5=86c5405a9226040aca68f073bbc5c0a0' target='_blank'>http://www.threatexpert.com/report.aspx?md5=86c5405a9226040aca68f073bbc5c0a0</a> 

packers (Kaspersky): UPX 

CWSandbox info: <a href='http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=86c5405a9226040aca68f073bbc5c0a0' target='_blank'>http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=86c5405a9226040aca68f073bbc5c0a0</a> 

packers (F-Prot): UPX

Zitat:

c:\windows\System32\bdod.bin

Code:



a-squared 4.0.0.93 2009.02.19 - 

AhnLab-V3 2009.2.19.0 2009.02.18 - 

AntiVir 7.9.0.83 2009.02.18 - 

Authentium 5.1.0.4 2009.02.18 - 

Avast 4.8.1335.0 2009.02.18 - 

AVG 8.0.0.237 2009.02.19 - 

BitDefender 7.2 2009.02.19 - 

CAT-QuickHeal 10.00 2009.02.18 - 

ClamAV 0.94.1 2009.02.18 - 

Comodo 983 2009.02.18 - 

DrWeb 4.44.0.09170 2009.02.19 - 

eSafe 7.0.17.0 2009.02.18 - 

eTrust-Vet 31.6.6364 2009.02.19 - 

F-Prot 4.4.4.56 2009.02.18 - 

F-Secure 8.0.14470.0 2009.02.19 - 

Fortinet 3.117.0.0 2009.02.18 - 

GData 19 2009.02.19 - 

Ikarus T3.1.1.45.0 2009.02.19 - 

K7AntiVirus 7.10.630 2009.02.18 - 

Kaspersky 7.0.0.125 2009.02.19 - 

McAfee 5529 2009.02.17 - 

McAfee+Artemis 5529 2009.02.17 - 

Microsoft 1.4306 2009.02.18 - 

NOD32 3866 2009.02.18 - 

Norman 6.00.06 2009.02.18 - 

nProtect 2009.1.8.0 2009.02.19 - 

Panda 9.4.3.20 2009.02.18 - 

PCTools 4.4.2.0 2009.02.18 - 

Prevx1 V2 2009.02.19 - 

Rising 21.17.22.00 2009.02.18 - 

SecureWeb-Gateway 6.7.6 2009.02.18 - 

Sophos 4.38.0 2009.02.18 - 

Sunbelt 3.2.1855.2 2009.02.17 - 

Symantec 10 2009.02.19 - 

TheHacker 6.3.2.2.259 2009.02.18 - 

TrendMicro 8.700.0.1004 2009.02.18 - 

VBA32 3.12.10.0 2009.02.18 - 

ViRobot 2009.2.18.1613 2009.02.18 - 

VirusBuster 4.5.11.0 2009.02.18 - 

weitere Informationen 

File size: 81984 bytes 

MD5...: b5c0d665245f4aaa116d865722642886 

SHA1..: 87870042cd0e502c1d2c29449c1349012f17f076 

SHA256: ce6f9d87aef042c21c191da0854aeef3bd7f25578127c5aa295ce9aabb6829eb 

SHA512: 6b2c858ab01b363d7196daee3f186bd5375552004f1e6d34e09d4c42e29dd1ad

34cdd97da3366e90238a648040362242b5c2da12af97109e73439ec0beefec0c 

ssdeep: 384:ddGA5DR3l+a366tbHz/Fl/5bUaihYbreReHawj3Jm0jwjo1i3oEZwPvXssss

sW8W:dpFOwrrJvMj42FuHsssssWSgx

 

PEiD..: - 

TrID..: File type identification

Unknown! 

PEInfo: -

jackaces

19.02.2009 03:32

Zitat:

c:\windows\System32\wininet.dll

Code:

a-squared 4.0.0.93 2009.02.19 - 

AhnLab-V3 2009.2.19.0 2009.02.18 - 

AntiVir 7.9.0.83 2009.02.18 - 

Authentium 5.1.0.4 2009.02.18 - 

Avast 4.8.1335.0 2009.02.18 - 

AVG 8.0.0.237 2009.02.19 - 

BitDefender 7.2 2009.02.19 - 

CAT-QuickHeal 10.00 2009.02.18 - 

ClamAV 0.94.1 2009.02.18 - 

Comodo 983 2009.02.18 - 

DrWeb 4.44.0.09170 2009.02.19 - 

eSafe 7.0.17.0 2009.02.18 - 

eTrust-Vet 31.6.6364 2009.02.19 - 

F-Prot 4.4.4.56 2009.02.18 - 

F-Secure 8.0.14470.0 2009.02.19 - 

Fortinet 3.117.0.0 2009.02.18 - 

GData 19 2009.02.19 - 

Ikarus T3.1.1.45.0 2009.02.19 - 

K7AntiVirus 7.10.630 2009.02.18 - 

Kaspersky 7.0.0.125 2009.02.19 - 

McAfee 5529 2009.02.17 - 

McAfee+Artemis 5529 2009.02.17 - 

Microsoft 1.4306 2009.02.18 - 

NOD32 3866 2009.02.18 - 

Norman 6.00.06 2009.02.18 - 

nProtect 2009.1.8.0 2009.02.19 - 

Panda 9.4.3.20 2009.02.18 - 

PCTools 4.4.2.0 2009.02.18 - 

Prevx1 V2 2009.02.19 - 

Rising 21.17.22.00 2009.02.18 - 

SecureWeb-Gateway 6.7.6 2009.02.18 - 

Sophos 4.38.0 2009.02.18 - 

Sunbelt 3.2.1855.2 2009.02.17 - 

Symantec 10 2009.02.19 - 

TheHacker 6.3.2.2.259 2009.02.18 - 

TrendMicro 8.700.0.1004 2009.02.18 - 

VBA32 3.12.10.0 2009.02.18 - 

ViRobot 2009.2.18.1613 2009.02.18 - 

VirusBuster 4.5.11.0 2009.02.18 - 

weitere Informationen 

File size: 827392 bytes 

MD5...: fb79a2aa5e92653b9a394fe26d799bf8 

SHA1..: 43c9ec603bafd029fadd624b37f3a69fdabd8b06 

SHA256: 32078f9187c93831f73060894a79cca85cbc35f85434952ad45ab9df203ceb26 

SHA512: fc3259ec7c9c59f35d74d39f4aeb9daf4205501aa8aae6d0e32039cb26566c24

3b8b0ee089a9bde249d39744b6f289e44e3d16cdc288ee6a3b979239c64c6121 

ssdeep: 12288:3k+p7d80EidHyru31JreaZ7xYgokqwONoTPIot32dkMMIMMutuEfXlf:Um

hPvJBFj7xzOyTPjmdkMMIMMurl

 

PEiD..: - 

TrID..: File type identification

Win64 Executable Generic (59.6%)

Win32 Executable MS Visual C++ (generic) (26.2%)

Win32 Executable Generic (5.9%)

Win32 Dynamic Link Library (generic) (5.2%)

Generic Win/DOS Executable (1.3%) 

PEInfo: PE Structure information
 

( base data )

entrypointaddress.: 0x7172169e

timedatestamp.....: 0x496ed17b (Thu Jan 15 06:02:35 2009)

machinetype.......: 0x14c (I386)
 

( 4 sections )

name viradd virsiz rawdsiz ntrpy md5

.text 0x1000 0x9b230 0x9b400 6.60 d663c0427f3837223fbe2d16bdec3b26

.data 0x9d000 0x7798 0x4200 1.42 75410b0084e119c26f4e77bb0e9fc9b9

.rsrc 0xa5000 0x24d58 0x24e00 4.73 fb53221d321a79956b7c441500d550d9

.reloc 0xca000 0x56b0 0x5800 6.73 4903969d40cde619b28255e11242dd91
 

( 8 imports ) 

> msvcrt.dll: _isatty, _write, _lseeki64, _fileno, __pioinfo, __badioinfo, wctomb, _itoa, _snprintf, _iob, isleadbyte, _onexit, _lock, __dllonexit, _unlock, _adjust_fdiv, _amsg_exit, _initterm, _XcptFilter, islower, __isascii, strtol, memmove, strrchr, atoi, realloc, free, malloc, wcstok, _vsnprintf, memcpy, memset, _vsnwprintf, wcsncmp, bsearch, _wcsnicmp, _wtoi, _wcsicmp, isupper, strncmp, wcsstr, _purecall, _mbstok, iscntrl, ispunct, strtoul, time, iswdigit, isalpha, atol, isalnum, _errno, isspace, strpbrk, isdigit, isxdigit, memchr

> ntdll.dll: RtlConvertSidToUnicodeString, RtlUnwind, RtlMoveMemory

> SHLWAPI.dll: SHRegGetValueW, PathAddBackslashW, -, SHRegGetValueA, StrRChrW, PathRemoveBackslashA, PathRemoveFileSpecA, -, PathRemoveBlanksA, PathAddBackslashA, -, PathAppendA, -, PathUnExpandEnvStringsA, PathRenameExtensionA, SHDeleteKeyA, SHDeleteValueW, StrCmpNIW, StrCmpNIA, StrStrA, -, StrChrW, StrChrA, -, -, UrlCombineW, UrlCanonicalizeW, -, PathCreateFromUrlW, UrlUnescapeA, UrlCombineA, UrlCanonicalizeA, StrToIntW, StrCmpW, StrCmpNA, StrRChrA, StrToIntA, StrStrIW, SHGetValueA, SHSetValueA, SHGetValueW, SHSetValueW, -, -, PathCombineW, PathFindFileNameW, StrStrIA

> ADVAPI32.dll: RegDeleteKeyA, RegCreateKeyExW, RegDeleteValueW, RegSetValueExW, RegQueryValueExW, CryptAcquireContextA, CryptGenRandom, CryptReleaseContext, RegOpenKeyA, RegEnumKeyA, TraceEvent, DuplicateTokenEx, ConvertStringSidToSidA, GetLengthSid, SetTokenInformation, CreateProcessAsUserA, ConvertStringSecurityDescriptorToSecurityDescriptorA, GetSidSubAuthorityCount, GetSidSubAuthority, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, RegDeleteValueA, OpenThreadToken, OpenProcessToken, GetTokenInformation, RegOpenKeyExW, UnregisterTraceGuids, RegisterTraceGuidsA, RegQueryInfoKeyW, GetTraceLoggerHandle, GetTraceEnableLevel, GetTraceEnableFlags, RegCreateKeyExA, RegSetValueExA, RegOpenKeyExA, RegQueryValueExA, RegQueryInfoKeyA, RegEnumKeyExA, RegCloseKey, GetUserNameA, OpenSCManagerA, OpenServiceA, CloseServiceHandle, QueryServiceStatus

> KERNEL32.dll: DosDateTimeToFileTime, GetEnvironmentVariableA, GetShortPathNameA, GetShortPathNameW, FindFirstFileA, RemoveDirectoryA, FindNextFileA, FindClose, GetDiskFreeSpaceExA, CopyFileA, SetFileTime, CreateDirectoryA, GetWindowsDirectoryA, GetSystemDirectoryA, GetPrivateProfileStringA, GetFileAttributesA, SetFileAttributesA, GetFileAttributesExA, FileTimeToDosDateTime, GetFileSizeEx, lstrcmpW, RaiseException, MoveFileExA, MoveFileA, LocalFileTimeToFileTime, CreateSemaphoreA, ReleaseSemaphore, GetCurrentProcessId, GetFileTime, lstrcmpA, GetModuleHandleExA, ResumeThread, FreeLibraryAndExitThread, ExpandEnvironmentStringsA, GetSystemTimeAsFileTime, DeleteFileW, GetACP, InterlockedExchangeAdd, CreateThread, Sleep, OpenMutexA, GetModuleHandleA, FormatMessageA, SetErrorMode, FlushViewOfFile, SystemTimeToFileTime, GetTickCount, TlsFree, TlsGetValue, GetCurrentThreadId, TlsSetValue, TlsAlloc, GetDateFormatA, GetTimeFormatA, GlobalAlloc, InterlockedCompareExchange, GetCurrentThread, GetCurrentProcess, IsDBCSLeadByte, IsValidCodePage, GlobalFree, lstrlenW, DeleteFileA, FormatMessageW, GetSystemTime, WritePrivateProfileStringA, GetVersionExA, GetModuleFileNameA, WriteFile, SetFilePointer, CreateFileW, CreateFileA, GetFileSize, ReadFile, FileTimeToSystemTime, LocalReAlloc, InitializeCriticalSection, InterlockedDecrement, lstrlenA, lstrcmpiA, InterlockedIncrement, DeleteCriticalSection, ResetEvent, LocalFree, ReleaseMutex, CompareStringA, CreateMutexA, CreateEventA, MultiByteToWideChar, WideCharToMultiByte, WaitForSingleObject, OutputDebugStringA, UnmapViewOfFile, SetEndOfFile, MapViewOfFileEx, CreateFileMappingA, OpenFileMappingA, LoadLibraryW, HeapFree, HeapAlloc, GetProcessHeap, GetTimeFormatW, GetDateFormatW, GetUserDefaultLCID, GetModuleFileNameW, GetComputerNameA, LoadResource, FindResourceExW, LocalAlloc, LoadLibraryExW, MapViewOfFile, CreateFileMappingW, GetLocaleInfoW, GetVersionExW, GetSystemDefaultUILanguage, GetUserDefaultUILanguage, FindResourceW, SearchPathW, CreateActCtxW, ReleaseActCtx, ActivateActCtx, DeactivateActCtx, SetFileAttributesW, InitializeCriticalSectionAndSpinCount, WritePrivateProfileStringW, GetFileAttributesW, GetModuleHandleW, GlobalUnlock, GlobalLock, QueryPerformanceCounter, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDBCSLeadByteEx, GetProcAddress, LoadLibraryA, FreeLibrary, SetEvent, InterlockedExchange, CloseHandle, GetLastError, SetLastError, EnterCriticalSection, LeaveCriticalSection, CompareStringW

> USER32.dll: CheckDlgButton, SendMessageW, SendMessageA, IsDlgButtonChecked, DefWindowProcA, SetWindowLongA, GetWindowLongA, RegisterClassW, CreateWindowExW, SetTimer, GetWindowTextW, MessageBoxW, CharNextA, GetWindowInfo, CharToOemA, CharUpperA, CharLowerW, IsCharAlphaNumericA, GetWindowThreadProcessId, EnumChildWindows, IsWindowVisible, GetAncestor, EnumWindows, CharNextExA, PostMessageA, IsWindow, SetWindowPos, SetDlgItemTextW, DestroyIcon, SetForegroundWindow, GetWindow, GetWindowRect, EqualRect, IntersectRect, EndDialog, SetFocus, GetDlgItem, SetWindowTextW, EnableWindow, KillTimer, FindWindowW, RegisterWindowMessageW, PostMessageW, DestroyWindow, LoadStringW, DialogBoxParamW, GetDesktopWindow, SendDlgItemMessageA, LoadIconA, LoadImageA, LoadStringA, CharLowerA

> Normaliz.dll: IdnToUnicode, IdnToAscii

> iertutil.dll: -, -, -, -
 

( 229 exports ) 

CommitUrlCacheEntryA, CommitUrlCacheEntryW, CreateMD5SSOHash, CreateUrlCacheContainerA, CreateUrlCacheContainerW, CreateUrlCacheEntryA, CreateUrlCacheEntryW, CreateUrlCacheGroup, DeleteIE3Cache, DeleteUrlCacheContainerA, DeleteUrlCacheContainerW, DeleteUrlCacheEntry, DeleteUrlCacheEntryA, DeleteUrlCacheEntryW, DeleteUrlCacheGroup, DetectAutoProxyUrl, DispatchAPICall, DllInstall, FindCloseUrlCache, FindFirstUrlCacheContainerA, FindFirstUrlCacheContainerW, FindFirstUrlCacheEntryA, FindFirstUrlCacheEntryExA, FindFirstUrlCacheEntryExW, FindFirstUrlCacheEntryW, FindFirstUrlCacheGroup, FindNextUrlCacheContainerA, FindNextUrlCacheContainerW, FindNextUrlCacheEntryA, FindNextUrlCacheEntryExA, FindNextUrlCacheEntryExW, FindNextUrlCacheEntryW, FindNextUrlCacheGroup, ForceNexusLookup, ForceNexusLookupExW, FreeUrlCacheSpaceA, FreeUrlCacheSpaceW, FtpCommandA, FtpCommandW, FtpCreateDirectoryA, FtpCreateDirectoryW, FtpDeleteFileA, FtpDeleteFileW, FtpFindFirstFileA, FtpFindFirstFileW, FtpGetCurrentDirectoryA, FtpGetCurrentDirectoryW, FtpGetFileA, FtpGetFileEx, FtpGetFileSize, FtpGetFileW, FtpOpenFileA, FtpOpenFileW, FtpPutFileA, FtpPutFileEx, FtpPutFileW, FtpRemoveDirectoryA, FtpRemoveDirectoryW, FtpRenameFileA, FtpRenameFileW, FtpSetCurrentDirectoryA, FtpSetCurrentDirectoryW, GetUrlCacheConfigInfoA, GetUrlCacheConfigInfoW, GetUrlCacheEntryInfoA, GetUrlCacheEntryInfoExA, GetUrlCacheEntryInfoExW, GetUrlCacheEntryInfoW, GetUrlCacheGroupAttributeA, GetUrlCacheGroupAttributeW, GetUrlCacheHeaderData, GopherCreateLocatorA, GopherCreateLocatorW, GopherFindFirstFileA, GopherFindFirstFileW, GopherGetAttributeA, GopherGetAttributeW, GopherGetLocatorTypeA, GopherGetLocatorTypeW, GopherOpenFileA, GopherOpenFileW, HttpAddRequestHeadersA, HttpAddRequestHeadersW, HttpCheckDavCompliance, HttpEndRequestA, HttpEndRequestW, HttpOpenRequestA, HttpOpenRequestW, HttpQueryInfoA, HttpQueryInfoW, HttpSendRequestA, HttpSendRequestExA, HttpSendRequestExW, HttpSendRequestW, IncrementUrlCacheHeaderData, InternetAlgIdToStringA, InternetAlgIdToStringW, InternetAttemptConnect, InternetAutodial, InternetAutodialCallback, InternetAutodialHangup, InternetCanonicalizeUrlA, InternetCanonicalizeUrlW, InternetCheckConnectionA, InternetCheckConnectionW, InternetClearAllPerSiteCookieDecisions, InternetCloseHandle, InternetCombineUrlA, InternetCombineUrlW, InternetConfirmZoneCrossing, InternetConfirmZoneCrossingA, InternetConfirmZoneCrossingW, InternetConnectA, InternetConnectW, InternetCrackUrlA, InternetCrackUrlW, InternetCreateUrlA, InternetCreateUrlW, InternetDial, InternetDialA, InternetDialW, InternetEnumPerSiteCookieDecisionA, InternetEnumPerSiteCookieDecisionW, InternetErrorDlg, InternetFindNextFileA, InternetFindNextFileW, InternetFortezzaCommand, InternetGetCertByURL, InternetGetCertByURLA, InternetGetConnectedState, InternetGetConnectedStateEx, InternetGetConnectedStateExA, InternetGetConnectedStateExW, InternetGetCookieA, InternetGetCookieExA, InternetGetCookieExW, InternetGetCookieW, InternetGetLastResponseInfoA, InternetGetLastResponseInfoW, InternetGetPerSiteCookieDecisionA, InternetGetPerSiteCookieDecisionW, InternetGetSecurityInfoByURL, InternetGetSecurityInfoByURLA, InternetGetSecurityInfoByURLW, InternetGoOnline, InternetGoOnlineA, InternetGoOnlineW, InternetHangUp, InternetInitializeAutoProxyDll, InternetLockRequestFile, InternetOpenA, InternetOpenUrlA, InternetOpenUrlW, InternetOpenW, InternetQueryDataAvailable, InternetQueryFortezzaStatus, InternetQueryOptionA, InternetQueryOptionW, InternetReadFile, InternetReadFileExA, InternetReadFileExW, InternetSecurityProtocolToStringA, InternetSecurityProtocolToStringW, InternetSetCookieA, InternetSetCookieExA, InternetSetCookieExW, InternetSetCookieW, InternetSetDialState, InternetSetDialStateA, InternetSetDialStateW, InternetSetFilePointer, InternetSetOptionA, InternetSetOptionExA, InternetSetOptionExW, InternetSetOptionW, InternetSetPerSiteCookieDecisionA, InternetSetPerSiteCookieDecisionW, InternetSetStatusCallback, InternetSetStatusCallbackA, InternetSetStatusCallbackW, InternetShowSecurityInfoByURL, InternetShowSecurityInfoByURLA, InternetShowSecurityInfoByURLW, InternetTimeFromSystemTime, InternetTimeFromSystemTimeA, InternetTimeFromSystemTimeW, InternetTimeToSystemTime, InternetTimeToSystemTimeA, InternetTimeToSystemTimeW, InternetUnlockRequestFile, InternetWriteFile, InternetWriteFileExA, InternetWriteFileExW, IsHostInProxyBypassList, IsUrlCacheEntryExpiredA, IsUrlCacheEntryExpiredW, LoadUrlCacheContent, ParseX509EncodedCertificateForListBoxEntry, PrivacyGetZonePreferenceW, PrivacySetZonePreferenceW, ReadUrlCacheEntryStream, RegisterUrlCacheNotification, ResumeSuspendedDownload, RetrieveUrlCacheEntryFileA, RetrieveUrlCacheEntryFileW, RetrieveUrlCacheEntryStreamA, RetrieveUrlCacheEntryStreamW, RunOnceUrlCache, SetUrlCacheConfigInfoA, SetUrlCacheConfigInfoW, SetUrlCacheEntryGroup, SetUrlCacheEntryGroupA, SetUrlCacheEntryGroupW, SetUrlCacheEntryInfoA, SetUrlCacheEntryInfoW, SetUrlCacheGroupAttributeA, SetUrlCacheGroupAttributeW, SetUrlCacheHeaderData, ShowCertificate, ShowClientAuthCerts, ShowSecurityInfo, ShowX509EncodedCertificate, UnlockUrlCacheEntryFile, UnlockUrlCacheEntryFileA, UnlockUrlCacheEntryFileW, UnlockUrlCacheEntryStream, UpdateUrlCacheContentPath, UrlZonesDetach, _GetFileExtensionFromUrl

Zitat:

c:\windows\System32\drivers\jmcr.sys

Code:

a-squared 4.0.0.93 2009.02.19 - 

AhnLab-V3 2009.2.19.0 2009.02.18 - 

AntiVir 7.9.0.83 2009.02.18 - 

Authentium 5.1.0.4 2009.02.18 - 

Avast 4.8.1335.0 2009.02.18 - 

AVG 8.0.0.237 2009.02.19 - 

BitDefender 7.2 2009.02.19 - 

CAT-QuickHeal 10.00 2009.02.18 - 

ClamAV 0.94.1 2009.02.18 - 

Comodo 983 2009.02.18 - 

DrWeb 4.44.0.09170 2009.02.19 - 

eSafe 7.0.17.0 2009.02.18 - 

eTrust-Vet 31.6.6364 2009.02.19 - 

F-Prot 4.4.4.56 2009.02.18 - 

F-Secure 8.0.14470.0 2009.02.19 - 

Fortinet 3.117.0.0 2009.02.18 - 

GData 19 2009.02.19 - 

Ikarus T3.1.1.45.0 2009.02.19 - 

K7AntiVirus 7.10.630 2009.02.18 - 

Kaspersky 7.0.0.125 2009.02.19 - 

McAfee 5529 2009.02.17 - 

McAfee+Artemis 5529 2009.02.17 - 

Microsoft 1.4306 2009.02.18 - 

NOD32 3866 2009.02.18 - 

Norman 6.00.06 2009.02.18 - 

nProtect 2009.1.8.0 2009.02.19 - 

Panda 9.4.3.20 2009.02.18 - 

PCTools 4.4.2.0 2009.02.18 - 

Prevx1 V2 2009.02.19 - 

Rising 21.17.22.00 2009.02.18 - 

SecureWeb-Gateway 6.7.6 2009.02.18 - 

Sophos 4.38.0 2009.02.18 - 

Sunbelt 3.2.1855.2 2009.02.17 - 

Symantec 10 2009.02.19 - 

TheHacker 6.3.2.2.259 2009.02.18 - 

TrendMicro 8.700.0.1004 2009.02.18 - 

VBA32 3.12.10.0 2009.02.18 suspected of Win32.BrokenEmbeddedSignature  (paranoid heuristics) 

ViRobot 2009.2.18.1613 2009.02.18 - 

VirusBuster 4.5.11.0 2009.02.18 - 

weitere Informationen 

File size: 86672 bytes 

MD5...: 5ee25c846a119a75d66a485cf8e77e78 

SHA1..: 9fe0777dbc184f53be28b3d55d0ab22865ffe6c6 

SHA256: ec468157e6833fb468b64fcdcfb0a3dbf5a2764550313eaa9921e1d5c59c7ab7 

SHA512: 88f8c8eb789a3368ad45b52283dca94089bc69b1afd3574f10375e66eb5d8c88

34ef6bb79084b22fe3598ec8b671bfd55eeada3eea5a186abdf6875092b2e786 

ssdeep: 1536:QjVd2FS2Lc2HNQX+yooeV3UqOfnYVkNl9vNEf1fW6XCIrgAwckp:MWSJ9qV

RfkjQ+IrgAwckp

 

PEiD..: - 

TrID..: File type identification

Win32 Executable Generic (58.4%)

Clipper DOS Executable (13.8%)

Generic Win/DOS Executable (13.7%)

DOS Executable Generic (13.7%)

VXD Driver (0.2%) 

PEInfo: PE Structure information
 

( base data )

entrypointaddress.: 0x12e54

timedatestamp.....: 0x4833d024 (Wed May 21 07:32:52 2008)

machinetype.......: 0x14c (I386)
 

( 6 sections )

name viradd virsiz rawdsiz ntrpy md5

.text 0x480 0x1276c 0x12780 6.51 2a6847a040205d6750184627601ad3ab

.rdata 0x12c00 0x761 0x780 5.62 83c76f19fbba9715bbfe9cead0f73664

.data 0x13380 0x761 0x780 0.98 da287b85095fd9c057ff167e9fcf6fc4

INIT 0x13b00 0x672 0x680 5.33 7ae27b6c5302c0da51713d7792eede8d

.rsrc 0x14180 0x3d8 0x400 3.29 3f1e25dd0fad01cc350fa29e46629616

.reloc 0x14580 0x926 0x980 5.43 d4b3957e6508c786c16acafa9ad34ebd
 

( 3 imports ) 

> ntoskrnl.exe: KeWaitForSingleObject, IoGetDeviceProperty, ObReferenceObjectByHandle, PsCreateSystemThread, KeSetTimerEx, ObfDereferenceObject, IoBuildSynchronousFsdRequest, IoGetAttachedDeviceReference, ExFreePoolWithTag, RtlInitUnicodeString, IoDeleteDevice, KeInitializeEvent, IoAttachDeviceToDeviceStack, IoCreateDevice, MmMapLockedPagesSpecifyCache, KeInitializeDpc, KeInitializeTimer, IofCallDriver, IoInvalidateDeviceState, ZwCreateKey, IoOpenDeviceRegistryKey, RtlWriteRegistryValue, ZwClose, PsGetVersion, KeQueryTimeIncrement, _allmul, KeTickCount, wcslen, KeRemoveQueueDpc, ExAllocatePoolWithTag, _alldiv, KeInitializeSpinLock, RtlQueryRegistryValues, PoStartNextPowerIrp, IofCompleteRequest, PoRequestPowerIrp, KeClearEvent, KeDelayExecutionThread, KeCancelTimer, PsTerminateSystemThread, KeInsertQueueDpc, RtlCompareMemory, IoDetachDevice, KeSetEvent

> HAL.dll: KfReleaseSpinLock, KfAcquireSpinLock, KeStallExecutionProcessor, HalGetBusDataByOffset, HalSetBusDataByOffset, KeGetCurrentIrql

> SCSIPORT.SYS: ScsiPortValidateRange, ScsiPortGetDeviceBase, ScsiPortInitialize, ScsiPortGetPhysicalAddress, ScsiPortCompleteRequest, ScsiPortNotification, ScsiPortGetBusData, ScsiPortSetBusDataByOffset, ScsiPortGetUncachedExtension
 

( 0 exports )

jackaces

19.02.2009 03:44

Zitat:

c:\windows\System32\Drivers\splq.sys

Diese Datei hab ich nicht gefunden.
nur z.B. spldr.sys oder spsys.sys

Zitat:

c:\windows\System32\Drivers\a4cspnj6.SYS

Diese Datei finde ich auch nicht um sie hochzuladen.

Gibt es denn einen Unterschied bei der Bezeichnung von Drivers und der Bezeichnung drivers
(außer die Groß/Kleinschreibweise) ?

jackaces

19.02.2009 03:57

Zitat:

c:\program files\TrueSuite Access Manager\IconOvrly.dll

Code:



a-squared 4.0.0.93 2009.02.19 - 

AhnLab-V3 2009.2.19.0 2009.02.18 - 

AntiVir 7.9.0.83 2009.02.18 - 

Authentium 5.1.0.4 2009.02.18 - 

Avast 4.8.1335.0 2009.02.18 - 

AVG 8.0.0.237 2009.02.19 - 

BitDefender 7.2 2009.02.19 - 

CAT-QuickHeal 10.00 2009.02.18 - 

ClamAV 0.94.1 2009.02.18 - 

Comodo 983 2009.02.18 - 

DrWeb 4.44.0.09170 2009.02.19 - 

eSafe 7.0.17.0 2009.02.18 - 

eTrust-Vet 31.6.6364 2009.02.19 - 

F-Prot 4.4.4.56 2009.02.18 - 

F-Secure 8.0.14470.0 2009.02.19 - 

Fortinet 3.117.0.0 2009.02.18 - 

GData 19 2009.02.19 - 

Ikarus T3.1.1.45.0 2009.02.19 - 

K7AntiVirus 7.10.630 2009.02.18 - 

Kaspersky 7.0.0.125 2009.02.19 - 

McAfee 5529 2009.02.17 - 

McAfee+Artemis 5529 2009.02.17 - 

Microsoft 1.4306 2009.02.18 - 

NOD32 3866 2009.02.18 - 

Norman 6.00.06 2009.02.18 - 

nProtect 2009.1.8.0 2009.02.19 - 

Panda 9.4.3.20 2009.02.18 - 

PCTools 4.4.2.0 2009.02.18 - 

Prevx1 V2 2009.02.19 - 

Rising 21.17.22.00 2009.02.18 - 

SecureWeb-Gateway 6.7.6 2009.02.18 - 

Sophos 4.38.0 2009.02.18 - 

Sunbelt 3.2.1855.2 2009.02.17 - 

Symantec 10 2009.02.19 - 

TheHacker 6.3.2.2.259 2009.02.18 - 

TrendMicro 8.700.0.1004 2009.02.18 - 

VBA32 3.12.10.0 2009.02.18 - 

ViRobot 2009.2.18.1613 2009.02.18 - 

VirusBuster 4.5.11.0 2009.02.18 - 

weitere Informationen 

File size: 118784 bytes 

MD5...: ddfc859ccb22e307d282549623ab6df6 

SHA1..: 5f7edf3a9f452d9440b7f7226637a64917b575ad 

SHA256: 42f1ab7761fb54593bc93f8a2f28cfb7b4887378d3f69450451b19e34de8e4cf 

SHA512: cba3291245d64209589450850c5e09fa63e2621675ba1c7096b6d80e13d70b05

25b0d6a7a78fb869cb02da17a0e0a9e7cf7cbb6c9247df86638ba3c8c00ff88c 

ssdeep: 1536:93DT5MwRZGnaFhrVC1m4CwTkItwWXqG5xWDXmw5mZ4I3:3MwEa066UDXl5m

Z4a

 

PEiD..: - 

TrID..: File type identification

Win32 Executable MS Visual C++ (generic) (65.2%)

Win32 Executable Generic (14.7%)

Win32 Dynamic Link Library (generic) (13.1%)

Generic Win/DOS Executable (3.4%)

DOS Executable Generic (3.4%) 

PEInfo: PE Structure information
 

( base data )

entrypointaddress.: 0x10009407

timedatestamp.....: 0x4628363f (Fri Apr 20 03:40:47 2007)

machinetype.......: 0x14c (I386)
 

( 5 sections )

name viradd virsiz rawdsiz ntrpy md5

.text 0x1000 0xfcec 0x10000 6.54 948114c5a6cebb5c359d2fd8eec49931

.rdata 0x11000 0x4ae6 0x5000 4.81 9a30ba8fd241d44849e1ea98d2f1d0f6

.data 0x16000 0x1ec0 0x2000 2.28 30fcf320d1954608dcdcc819319eb096

.rsrc 0x18000 0x1ec4 0x2000 3.89 b065e929c60dffd3985928a0122c2f05

.reloc 0x1a000 0x20ac 0x3000 3.51 880f4a03c32f6f350260d313bb6c5469
 

( 7 imports ) 

> dbghelp.dll: MakeSureDirectoryPathExists

> KERNEL32.dll: GetModuleFileNameW, InterlockedIncrement, FreeLibrary, MultiByteToWideChar, SizeofResource, LoadResource, FindResourceW, LoadLibraryExW, GetModuleHandleW, EnterCriticalSection, LeaveCriticalSection, SetThreadLocale, GetThreadLocale, GetFileAttributesW, FindClose, FindFirstFileW, Sleep, lstrlenA, FreeResource, LockResource, InterlockedDecrement, GetSystemDefaultLangID, EnumResourceLanguagesW, CloseHandle, WriteFile, CreateFileW, GetStringTypeW, GetStringTypeA, LCMapStringW, LCMapStringA, LoadLibraryA, GetSystemTimeAsFileTime, GetCurrentProcessId, GetTickCount, lstrcmpiW, GetLastError, DeleteCriticalSection, InitializeCriticalSection, RaiseException, lstrlenW, WideCharToMultiByte, FindResourceExW, QueryPerformanceCounter, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetEnvironmentStrings, FreeEnvironmentStringsA, GetStartupInfoA, GetFileType, SetHandleCount, HeapSize, SetLastError, TlsFree, InterlockedExchange, GetACP, GetLocaleInfoA, GetVersionExA, HeapAlloc, HeapFree, RtlUnwind, HeapReAlloc, GetCurrentThreadId, GetCommandLineA, GetProcessHeap, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, VirtualFree, VirtualAlloc, HeapDestroy, HeapCreate, GetProcAddress, GetModuleHandleA, ExitProcess, GetStdHandle, GetModuleFileNameA, GetCPInfo, GetOEMCP, IsValidCodePage, TlsGetValue, TlsAlloc, TlsSetValue

> USER32.dll: CharUpperW, UnregisterClassA, LoadStringW, CharNextW

> ADVAPI32.dll: RegEnumKeyExW, RegQueryInfoKeyW, RegSetValueExW, RegOpenKeyExW, RegCreateKeyExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW

> SHELL32.dll: SHGetSpecialFolderPathW, SHGetDesktopFolder, SHGetMalloc

> ole32.dll: StringFromCLSID, CoTaskMemFree, CoTaskMemRealloc, CoTaskMemAlloc, StringFromGUID2, CoCreateInstance

> OLEAUT32.dll: -, -, -, -, -, -, -
 

( 4 exports ) 

DllCanUnloadNow, DllGetClassObject, DllRegisterServer, DllUnregisterServer

jackaces

19.02.2009 04:10

@Chris4You

Zitat:

Du hast in dem Mountpoint einige autoruns drin, gewollt?
Sonst per Regedit die Schlüssel löschen...

Gewollt ist das sicher nicht. Ich muss zugeben ich hab echt wenig ahnung von dem, was in einem Läptop geschieht. was nicht heißen soll, das ich es mich hindert es verstehen zu wollen.
Ich bin deinen Tipp mit RegEdit nachgegangen und hab das alles entfernt.
(auf meine eigene Gefahr hin)
ich bin überzeugt, das wenn du mich schon fragst, ob diese Programme "gewollt" sind, sie nicht unbedingt von Nöten sind.

Zitat:

Wirst Du noch umgeleitet?

nein, ich werde seit dem Durchlauf von malwarebytes' anti-malware nicht mehr daran gehindert bzw. verzögert es sich nicht.

Habt alle beide echt vielen Dank für eure bisherigen Mühen und eure zugewendete Zeit.
Wenn ich euch aus meinem Metier heraus einen Gefallen tuen könnte, würde ich euch sofort nen Kuchen per Post zukommen lassen. Vielen Dank nochmals

Chris4You

19.02.2009 07:30

Hi,

wir löschen noch die beiden Files:
KILLBOX - Pocket KillBox
http://virus-protect.org/killbox.html
oder
http://www.wintotal.de/Software/index.php?id=4101

Options: Delete on Reboot --> anhaken
reinkopieren:
c:\windows\System32\xa68148085.exe
c:\windows\System32\xa68147897.exe
und klicke auf das rote Kreuz, wenn gefragt wird, ob "Do you want to reboot? "---- klicke auf "no",und kopiere das nächste rein, erst beim letzten auf "yes"

PC neustarten

chris

jackaces

19.02.2009 14:48

hey Chris,

habs erledigt. die Dateien sind aber noch da. zumindest ihr Symbole.

aber er sagt mir: (bei einem weiteren Durchlauf)

PendingFileRenameOperations Registry Data has been Removed by External Process!

Danke

Chris4You

19.02.2009 15:47

Hi,

das hört sich nicht gut an...

Also:
Anleitung Avenger (by swandog46)

1.) Lade dir das Tool Avenger und speichere es auf dem Desktop:

http://saved.im/mzi3ndg3nta0/aven.jpg

2.) Das Programm so einstellen wie es auf dem Bild zu sehen ist.

Kopiere nun folgenden Text in das weiße Feld:
(bei -> "input script here")

Code:

Files to delete:

c:\windows\System32\xa68148085.exe

c:\windows\System32\xa68147897.exe

3.) Schliesse nun alle Programme (vorher notfalls abspeichern!) und Browser-Fenster, nach dem Ausführen des Avengers wird das System neu gestartet.

4.) Um den Avenger zu starten klicke auf -> Execute
Dann bestätigen mit "Yes" das der Rechner neu startet!

5.) Nachdem das System neu gestartet ist, findest du hier einen Report vom Avenger -> C:\avenger.txt
Öffne die Datei mit dem Editor und kopiere den gesamten Text in deinen Beitrag hier am Trojaner-Board.

Dann bemühen wir noch Prevx:
Poste eventuelle Funde!, nur die:
http://www.prevx.com/freescan.asp

Bitte prüfen:
Arbeitsplatz->rechte Maustaste->Eigenschaften->Hardware->Gerätemanager->Ansicht-> ausgeblendete Geräte anzeigen->Nicht PnP-Treiber
und dort den Treiber "TDSSserv.sys" oder aehnlich deaktivieren und neu starten.

chris

jackaces

19.02.2009 22:51

Avenger sagt, die Dateien sind nicht mehr vorhanden. ich hab sie dann auch nicht mehr gefunden

PrevX CSI hat auch was gefunden---ist jetzt weg

Zitat:

Bitte prüfen:
Arbeitsplatz->rechte Maustaste->Eigenschaften->Hardware->Gerätemanager->Ansicht-> ausgeblendete Geräte anzeigen->Nicht PnP-Treiber
und dort den Treiber "TDSSserv.sys" oder aehnlich deaktivieren und neu starten.

Diese Datei(sys) hab ich nicht gefunden.als ob sie nicht vorhanden ist.
ich hab den Pfad genauso befolgt und das hat auch so geklappt. aber sie war nicht da.

ich lass jetzt nacheinander malwarebytes' anti-malware; spybot search&destroy; prevx csi und SUPERAntiSpyware durchlaufen.

"Welche davon soll ich denn behalten?" Alle?

Gruß Rob

Chris4You

20.02.2009 07:49

Hi,

von Spyboot halte ich eigentlich nicht viel, Prevx würde ich drauflassen, der verträgt sich eigentlich recht gut mit anderen Lösungen (allerdings ist das kein "Realtime"-Schutz, dazu z. B. Avira etc. (was halt einen Guard hat))...

Was hatte Prevx noch gefunden?

Wir prüfen noch kurz den Bootblock (war vor einiger Zeit bei den Hackern mal "inn"):
MBR-Rootkit

Lade den MBR-Rootkitscanner von Gmer auf Deine Bootplatte:
http://www2.gmer.net/mbr/mbr.exe
Merke Dir das Verzeichnis wo Du ihn runtergeladen hast;
Start->Ausführen->cmd
Wechsle in das Verzeichnis des Downloads und starte durch Eingabe
von mbr das Programm...

Das Ergebnis sollte so aussehen:

Zitat:

D:\Downloads>mbr
Stealth MBR rootkit detector 0.2.4 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK

In dem Verzeichnis wo mbr.exe liegt findest Du das Log,

poste es im Thread;

chris

jackaces

20.02.2009 16:12

Stealth MBR rootkit detector 0.2.4 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK

beim ersten durchlauf ergab es, das user und kernel nicht funktionieren. beim zweiten anlauf hat es dann geklappt.

jackaces

20.02.2009 16:24

prevx hat nichts mehr gefunden.
das sagt es sei alles clean

jackaces

22.02.2009 01:00

Weiteres VorGehen?????

Chris4You

22.02.2009 15:01

Hi,

was treibt der Rechner?
Zu finden ist jetzt nichts mehr, entweder was sehr neues (was noch kein Scanner anzeigen kann bzw. sich gut genug versteckt)...
Gehst Du über einen Router ins Internet?

Alternativ um alle möglichen Beeinflussungen ausschließen zu können, bleibt nur noch ein Scann von einer Boot-CD...
z. B.:
Antivir, Rescue-CD
http://www.avira.de/de/support/support_downloads.html
Dort bitte das Rescue System sowie das update
dazu runterladen. Beim Start der Anwendung leere CD in den Brenner,
CD brennen lassen. Zweite CD brennen mit dem ausgepackten Update.
Von CD booten (Einstellung im BIOS vornehmen)...
http://www.pcwelt.de/start/sicherheit/antivirus/news/149200/

chris

jackaces

22.03.2009 16:57

der läuft wieder spitze.
danke für deine Hilfe.

es ist jetzt wieder alles in Ordnung.
Grüße R.

Alle Zeitangaben in WEZ +1. Es ist jetzt 18:27 Uhr.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19